{"@timestamp":"2021-09-09T15:22:12.819Z", "log.level": "INFO", "message":"version[8.0.0-SNAPSHOT], pid[36437], build[default/tar/e729c3f543da1104e5691a07d26b923d9839cdd6/2021-09-08T15:23:10.669744690Z], OS[Mac OS X/11.5/x86_64], JVM[Eclipse Foundation/OpenJDK 64-Bit Server VM/16.0.2/16.0.2+7]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:12.825Z", "log.level": "INFO", "message":"JVM home [/Users/jdover/src/kibana/.es/8.0.0/jdk.app/Contents/Home], using bundled JDK [true]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:12.826Z", "log.level": "INFO", "message":"JVM arguments [-Xshare:auto, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -XX:+ShowCodeDetailsInExceptionMessages, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=SPI,COMPAT, --add-opens=java.base/java.io=ALL-UNNAMED, -XX:+UseG1GC, -Djava.io.tmpdir=/Users/jdover/src/kibana/.es/8.0.0/ES_TMPDIR, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Xms1g, -Xmx1g, -XX:MaxDirectMemorySize=536870912, -XX:G1HeapRegionSize=4m, -XX:InitiatingHeapOccupancyPercent=30, -XX:G1ReservePercent=15, -Des.path.home=/Users/jdover/src/kibana/.es/8.0.0, -Des.path.conf=/Users/jdover/src/kibana/.es/8.0.0/config, -Des.distribution.flavor=default, -Des.distribution.type=tar, -Des.bundled_jdk=true]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:12.827Z", "log.level": "WARN", "message":"version [8.0.0-SNAPSHOT] is a pre-release version of Elasticsearch and is not suitable for production", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.214Z", "log.level": "INFO", "message":"loaded module [aggs-matrix-stats]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.214Z", "log.level": "INFO", "message":"loaded module [analysis-common]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.215Z", "log.level": "INFO", "message":"loaded module [constant-keyword]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.215Z", "log.level": "INFO", "message":"loaded module [frozen-indices]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.215Z", "log.level": "INFO", "message":"loaded module [ingest-common]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.215Z", "log.level": "INFO", "message":"loaded module [ingest-geoip]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.216Z", "log.level": "INFO", "message":"loaded module [ingest-user-agent]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.216Z", "log.level": "INFO", "message":"loaded module [kibana]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.216Z", "log.level": "INFO", "message":"loaded module [lang-expression]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.217Z", "log.level": "INFO", "message":"loaded module [lang-mustache]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.217Z", "log.level": "INFO", "message":"loaded module [lang-painless]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.217Z", "log.level": "INFO", "message":"loaded module [mapper-extras]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.218Z", "log.level": "INFO", "message":"loaded module [mapper-version]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.218Z", "log.level": "INFO", "message":"loaded module [parent-join]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.218Z", "log.level": "INFO", "message":"loaded module [percolator]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.218Z", "log.level": "INFO", "message":"loaded module [rank-eval]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.219Z", "log.level": "INFO", "message":"loaded module [reindex]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.219Z", "log.level": "INFO", "message":"loaded module [repositories-metering-api]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.219Z", "log.level": "INFO", "message":"loaded module [repository-encrypted]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.219Z", "log.level": "INFO", "message":"loaded module [repository-url]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.220Z", "log.level": "INFO", "message":"loaded module [runtime-fields-common]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.220Z", "log.level": "INFO", "message":"loaded module [search-business-rules]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.220Z", "log.level": "INFO", "message":"loaded module [searchable-snapshots]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.220Z", "log.level": "INFO", "message":"loaded module [snapshot-repo-test-kit]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.220Z", "log.level": "INFO", "message":"loaded module [spatial]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.221Z", "log.level": "INFO", "message":"loaded module [test-delayed-aggs]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.221Z", "log.level": "INFO", "message":"loaded module [test-die-with-dignity]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.221Z", "log.level": "INFO", "message":"loaded module [test-error-query]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.221Z", "log.level": "INFO", "message":"loaded module [transform]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.222Z", "log.level": "INFO", "message":"loaded module [transport-netty4]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.222Z", "log.level": "INFO", "message":"loaded module [unsigned-long]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.222Z", "log.level": "INFO", "message":"loaded module [vector-tile]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.222Z", "log.level": "INFO", "message":"loaded module [vectors]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.222Z", "log.level": "INFO", "message":"loaded module [wildcard]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.223Z", "log.level": "INFO", "message":"loaded module [x-pack-aggregate-metric]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.223Z", "log.level": "INFO", "message":"loaded module [x-pack-analytics]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.223Z", "log.level": "INFO", "message":"loaded module [x-pack-async]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.223Z", "log.level": "INFO", "message":"loaded module [x-pack-async-search]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.223Z", "log.level": "INFO", "message":"loaded module [x-pack-autoscaling]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.224Z", "log.level": "INFO", "message":"loaded module [x-pack-ccr]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.224Z", "log.level": "INFO", "message":"loaded module [x-pack-core]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.224Z", "log.level": "INFO", "message":"loaded module [x-pack-data-streams]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.225Z", "log.level": "INFO", "message":"loaded module [x-pack-deprecation]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.225Z", "log.level": "INFO", "message":"loaded module [x-pack-enrich]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.225Z", "log.level": "INFO", "message":"loaded module [x-pack-eql]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.225Z", "log.level": "INFO", "message":"loaded module [x-pack-fleet]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.225Z", "log.level": "INFO", "message":"loaded module [x-pack-graph]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.226Z", "log.level": "INFO", "message":"loaded module [x-pack-identity-provider]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.226Z", "log.level": "INFO", "message":"loaded module [x-pack-ilm]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.226Z", "log.level": "INFO", "message":"loaded module [x-pack-logstash]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.226Z", "log.level": "INFO", "message":"loaded module [x-pack-ml]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.226Z", "log.level": "INFO", "message":"loaded module [x-pack-monitoring]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.227Z", "log.level": "INFO", "message":"loaded module [x-pack-ql]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.227Z", "log.level": "INFO", "message":"loaded module [x-pack-rollup]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.227Z", "log.level": "INFO", "message":"loaded module [x-pack-security]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.227Z", "log.level": "INFO", "message":"loaded module [x-pack-shutdown]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.228Z", "log.level": "INFO", "message":"loaded module [x-pack-sql]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.228Z", "log.level": "INFO", "message":"loaded module [x-pack-stack]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.228Z", "log.level": "INFO", "message":"loaded module [x-pack-text-structure]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.228Z", "log.level": "INFO", "message":"loaded module [x-pack-voting-only-node]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.229Z", "log.level": "INFO", "message":"loaded module [x-pack-watcher]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.229Z", "log.level": "INFO", "message":"no plugins loaded", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.plugins.PluginsService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.257Z", "log.level": "INFO", "message":"using data path: mount [/System/Volumes/Data (/dev/disk1s2)], usable_space [620.5gb], total_space [931.5gb], type [apfs]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.env.NodeEnvironment","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.257Z", "log.level": "INFO", "message":"heap size [1gb], compressed ordinary object pointers [true]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.env.NodeEnvironment","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:15.273Z", "log.level": "INFO", "message":"node name [Joshs-MacBook-Pro.local], node ID [3RiJe2S3TCWXbzwX1pFRxQ], cluster name [elasticsearch], roles [data_content, data_warm, master, remote_cluster_client, data, data_cold, ingest, data_frozen, ml, data_hot, transform]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:18.450Z", "log.level": "INFO", "message":"[controller/36482] [Main.cc@123] controller (64 bit): Version 8.0.0-SNAPSHOT (Build 7bb2c7e05ef029) Copyright (c) 2021 Elasticsearch BV", "service.name":"ES_ECS","process.thread.name":"ml-cpp-log-tail-thread","log.logger":"org.elasticsearch.xpack.ml.process.logging.CppLogMessageHandler","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:18.550Z", "log.level": "INFO", "message":"Security is enabled", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.xpack.security.Security","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:18.823Z", "log.level": "INFO", "message":"license mode is [trial], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.xpack.security.authc.Realms","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:18.832Z", "log.level": "INFO", "message":"parsed [0] roles from file [/Users/jdover/src/kibana/.es/8.0.0/config/roles.yml]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.xpack.security.authz.store.FileRolesStore","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:19.343Z", "log.level": "INFO", "message":"initialized default databases [[GeoLite2-Country.mmdb, GeoLite2-City.mmdb, GeoLite2-ASN.mmdb]], config databases [[]] and watching [/Users/jdover/src/kibana/.es/8.0.0/config/ingest-geoip] for changes", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.ingest.geoip.LocalDatabases","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:19.344Z", "log.level": "INFO", "message":"initialized database registry, using geoip-databases directory [/Users/jdover/src/kibana/.es/8.0.0/ES_TMPDIR/geoip-databases/3RiJe2S3TCWXbzwX1pFRxQ]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.ingest.geoip.DatabaseRegistry","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:19.933Z", "log.level": "INFO", "message":"creating NettyAllocator with the following configs: [name=unpooled, suggested_max_allocation_size=1mb, factors={es.unsafe.use_unpooled_allocator=null, g1gc_enabled=true, g1gc_region_size=4mb, heap_size=1gb}]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.transport.NettyAllocator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:19.991Z", "log.level": "INFO", "message":"using discovery type [zen] and seed hosts providers [settings]", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.discovery.DiscoveryModule","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:20.743Z", "log.level": "INFO", "message":"initialized", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:20.743Z", "log.level": "INFO", "message":"starting ...", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:20.838Z", "log.level": "INFO", "message":"persistent cache index loaded", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.xpack.searchablesnapshots.cache.full.PersistentCache","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:20.951Z", "log.level": "INFO", "message":"publish_address {127.0.0.1:9300}, bound_addresses {[::1]:9300}, {127.0.0.1:9300}", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.transport.TransportService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:20.964Z", "log.level":"TRACE", "message":"clearing existing metadata", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:20.975Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:20.991Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:21.080Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote full state with [0] indices", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:21.165Z", "log.level": "WARN", "message":"the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.bootstrap.BootstrapChecks","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:21.165Z", "log.level": "WARN", "message":"HTTPS is required in order to use the API key service; please enable HTTPS using the [xpack.security.http.ssl.enabled] setting or disable the API key service using the [xpack.security.authc.api_key.enabled] setting", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.bootstrap.BootstrapChecks","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:21.169Z", "log.level":"DEBUG", "message":"startInitialJoin: coordinator becoming CANDIDATE in term 0 (was null, lastKnownLeader was [Optional.empty])", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:21.172Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:21.175Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=0, lastAcceptedTerm=0, lastAcceptedVersion=0}, leader=null", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:21.175Z", "log.level": "INFO", "message":"no discovery configuration found, will perform best-effort cluster bootstrapping after [3s] unless existing master is discovered", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.cluster.coordination.ClusterBootstrapService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.177Z", "log.level":"DEBUG", "message":"performing best-effort cluster bootstrapping with [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.ClusterBootstrapService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.178Z", "log.level": "INFO", "message":"setting initial configuration to VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.179Z", "log.level":"TRACE", "message":"currentTerm [0] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.180Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.183Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.271Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.271Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=0, lastAcceptedTerm=0, lastAcceptedVersion=0}, leader=null", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.275Z", "log.level":"DEBUG", "message":"scheduling scheduleNextElection{gracePeriod=0s, thisAttempt=0, maxDelayMillis=100, delayMillis=75, ElectionScheduler{attempt=1, ElectionSchedulerFactory{initialTimeout=100ms, backoffTime=100ms, maxTimeout=10s}}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.ElectionSchedulerFactory","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.355Z", "log.level":"DEBUG", "message":"scheduleNextElection{gracePeriod=0s, thisAttempt=0, maxDelayMillis=100, delayMillis=75, ElectionScheduler{attempt=1, ElectionSchedulerFactory{initialTimeout=100ms, backoffTime=100ms, maxTimeout=10s}}} starting election", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.ElectionSchedulerFactory","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.355Z", "log.level":"DEBUG", "message":"scheduling scheduleNextElection{gracePeriod=500ms, thisAttempt=1, maxDelayMillis=200, delayMillis=636, ElectionScheduler{attempt=2, ElectionSchedulerFactory{initialTimeout=100ms, backoffTime=100ms, maxTimeout=10s}}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.ElectionSchedulerFactory","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.357Z", "log.level":"DEBUG", "message":"PreVotingRound{preVotesReceived={}, electionStarted=false, preVoteRequest=PreVoteRequest{sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, currentTerm=0}, isClosed=false} requesting pre-votes from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.373Z", "log.level":"DEBUG", "message":"PreVotingRound{preVotesReceived={{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}=PreVoteResponse{currentTerm=0, lastAcceptedTerm=0, lastAcceptedVersion=0}}, electionStarted=true, preVoteRequest=PreVoteRequest{sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, currentTerm=0}, isClosed=false} added PreVoteResponse{currentTerm=0, lastAcceptedTerm=0, lastAcceptedVersion=0} from {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, starting election", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.373Z", "log.level":"DEBUG", "message":"starting election with StartJoinRequest{term=1,node={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.375Z", "log.level":"DEBUG", "message":"joinLeaderInTerm: for [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}] with term 1", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.376Z", "log.level":"DEBUG", "message":"handleStartJoin: leaving term [0] due to StartJoinRequest{term=1,node={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.437Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=0, lastAcceptedVersion=0}, leader=null", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.441Z", "log.level":"DEBUG", "message":"attempting to join {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824} with JoinRequest{sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, minimumTerm=0, optionalJoin=Optional[Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}]}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.JoinHelper","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.442Z", "log.level":"DEBUG", "message":"successful response to StartJoinRequest{term=1,node={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}} from {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.JoinHelper","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.442Z", "log.level":"TRACE", "message":"handleJoinRequest: as CANDIDATE, handling JoinRequest{sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, minimumTerm=0, optionalJoin=Optional[Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}]}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.443Z", "log.level":"DEBUG", "message":"handleJoin: added join Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}} from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}] for election, electionWon=true lastAcceptedTerm=0 lastAcceptedVersion=0", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.444Z", "log.level":"DEBUG", "message":"handleJoin: election won in term [1] with VoteCollection{votes=[3RiJe2S3TCWXbzwX1pFRxQ], joins=[Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}]}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.444Z", "log.level":"DEBUG", "message":"handleJoinRequest: coordinator becoming LEADER in term 1 (was CANDIDATE, lastKnownLeader was [Optional.empty])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.447Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=0, lastAcceptedVersion=0}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.449Z", "log.level":"TRACE", "message":"becomeMasterAndTrimConflictingNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.JoinHelper","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.457Z", "log.level":"DEBUG", "message":"received a join request for an existing node [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.JoinHelper","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.459Z", "log.level": "INFO", "message":"elected-as-master ([1] nodes joined)[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw} elect leader, _BECOME_MASTER_TASK_, _FINISH_ELECTION_], term: 1, version: 1, delta: master node changed {previous [], current [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.service.MasterService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.462Z", "log.level":"TRACE", "message":"serialized full cluster state version [1] for node version [8.0.0] with size [748]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.463Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [1] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.466Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.470Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=1, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: false]\nversion: 1\nstate uuid: o5gT8-m6TsC0hUUIWpCeSg\nfrom_diff: false\nmeta data version: 1\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index-graveyard: IndexGraveyard[[]]\nblocks: \n   _global_:\n      1,state not recovered / initialized, blocks READ,WRITE,METADATA_READ,METADATA_WRITE\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 0):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.471Z", "log.level":"TRACE", "message":"sending full cluster state version [1] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.475Z", "log.level":"DEBUG", "message":"received full cluster state version [1] with size [748]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.476Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=1, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: false]\nversion: 1\nstate uuid: o5gT8-m6TsC0hUUIWpCeSg\nfrom_diff: false\nmeta data version: 1\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index-graveyard: IndexGraveyard[[]]\nblocks: \n   _global_:\n      1,state not recovered / initialized, blocks READ,WRITE,METADATA_READ,METADATA_WRITE\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 0):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.477Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [1] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.477Z", "log.level":"TRACE", "message":"clearing existing metadata", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.478Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.479Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.548Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote full state with [0] indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.549Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=1}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.549Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.550Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=1}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.551Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [1] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.551Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [1] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.553Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=1, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.553Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.553Z", "log.level": "INFO", "message":"cluster UUID set to [i416wADYTqGeMy1iAUtHvA]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.554Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.554Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.556Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.627Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.629Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=1}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.630Z", "log.level": "INFO", "message":"master node changed {previous [], current [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}]}, term: 1, version: 1, reason: Publication{term=1, version=1}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.service.ClusterApplierService","event.dataset":"elasticsearch.server","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.658Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=1}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.660Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.662Z", "log.level":"TRACE", "message":"lag detection for version 1 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.663Z", "log.level":"DEBUG", "message":"successfully joined {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824} with JoinRequest{sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, minimumTerm=0, optionalJoin=Optional[Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}]}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.JoinHelper","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.668Z", "log.level":"TRACE", "message":"post-join reroute completed", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.JoinHelper","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.668Z", "log.level": "INFO", "message":"publish_address {10.108.123.173:9200}, bound_addresses {[::]:9200}", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.http.AbstractHttpServerTransport","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.668Z", "log.level": "INFO", "message":"started", "service.name":"ES_ECS","process.thread.name":"main","log.logger":"org.elasticsearch.node.Node","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.669Z", "log.level":"TRACE", "message":"serialized full cluster state version [2] for node version [8.0.0] with size [701]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.669Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [2] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.670Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.670Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=2, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 2\nstate uuid: UTX2doT5RkKSzYQrdqm_QA\nfrom_diff: false\nmeta data version: 1\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.670Z", "log.level":"TRACE", "message":"sending full cluster state version [2] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.671Z", "log.level":"DEBUG", "message":"received full cluster state version [2] with size [701]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.671Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=2, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 2\nstate uuid: UTX2doT5RkKSzYQrdqm_QA\nfrom_diff: false\nmeta data version: 1\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.671Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [2] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.672Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.672Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.739Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.739Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=2}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.739Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.740Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=2}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.740Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [2] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.740Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [2] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.740Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=2, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.740Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [2]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.741Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=2}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.795Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=2}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.795Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.795Z", "log.level":"TRACE", "message":"lag detection for version 2 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.796Z", "log.level": "INFO", "message":"recovered [0] indices into cluster_state", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.gateway.GatewayService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.906Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#15]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.906Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#13]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.907Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#12]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.907Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#14]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.912Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#16]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.925Z", "log.level": "INFO", "message":"adding index template [.ml-anomalies-] for index patterns [.ml-anomalies-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.931Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [3] in for node version [8.0.0] with size [1667]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.931Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [3] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.931Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.933Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=3, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 3\nstate uuid: N70vYp4iSh-rf9UD_-mUGg\nfrom_diff: false\nmeta data version: 2\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.933Z", "log.level":"TRACE", "message":"sending cluster state diff for version [3] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.936Z", "log.level":"DEBUG", "message":"received diff cluster state version [3] with uuid [N70vYp4iSh-rf9UD_-mUGg], diff size [1667]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.937Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=3, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 3\nstate uuid: N70vYp4iSh-rf9UD_-mUGg\nfrom_diff: false\nmeta data version: 2\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.937Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [3] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.937Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:24.939Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.940Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:24.996Z", "log.level":"DEBUG", "message":"scheduleNextElection{gracePeriod=500ms, thisAttempt=1, maxDelayMillis=200, delayMillis=636, ElectionScheduler{attempt=2, ElectionSchedulerFactory{initialTimeout=100ms, backoffTime=100ms, maxTimeout=10s}}} not starting election", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.ElectionSchedulerFactory","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.010Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.011Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=3}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.011Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.012Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=3}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.012Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [3] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.012Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [3] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.012Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=3, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.013Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [3]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.013Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=3}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.019Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=3}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.020Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.020Z", "log.level":"TRACE", "message":"lag detection for version 3 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.029Z", "log.level": "INFO", "message":"adding index template [.ml-notifications-000002] for index patterns [.ml-notifications-000002]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.030Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [4] in for node version [8.0.0] with size [501]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.030Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [4] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.030Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.031Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=4, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 4\nstate uuid: Ek9FkhBGQV-K2ZIaASw1Zw\nfrom_diff: false\nmeta data version: 3\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.032Z", "log.level":"TRACE", "message":"sending cluster state diff for version [4] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.033Z", "log.level":"DEBUG", "message":"received diff cluster state version [4] with uuid [Ek9FkhBGQV-K2ZIaASw1Zw], diff size [501]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.034Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=4, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 4\nstate uuid: Ek9FkhBGQV-K2ZIaASw1Zw\nfrom_diff: false\nmeta data version: 3\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.035Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [4] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.035Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.036Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.038Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.168Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.168Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=4}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.168Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.169Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=4}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.169Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [4] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.169Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [4] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.169Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=4, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.170Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.170Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=4}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.179Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=4}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.179Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.180Z", "log.level":"TRACE", "message":"lag detection for version 4 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.187Z", "log.level": "INFO", "message":"adding index template [.ml-state] for index patterns [.ml-state*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.188Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [5] in for node version [8.0.0] with size [415]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.188Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [5] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.189Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.190Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=5, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 5\nstate uuid: _pUOUStRQ9Obos6CmQR9gQ\nfrom_diff: false\nmeta data version: 4\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.191Z", "log.level":"TRACE", "message":"sending cluster state diff for version [5] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.193Z", "log.level":"DEBUG", "message":"received diff cluster state version [5] with uuid [_pUOUStRQ9Obos6CmQR9gQ], diff size [415]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.195Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=5, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 5\nstate uuid: _pUOUStRQ9Obos6CmQR9gQ\nfrom_diff: false\nmeta data version: 4\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.195Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [5] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.195Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.198Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.200Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.255Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#2]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.256Z", "log.level": "INFO", "message":"security index does not exist, creating [.security-7] with alias [.security]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#1]","log.logger":"org.elasticsearch.xpack.security.support.SecurityIndexManager","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.283Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.284Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=5}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.284Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.284Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=5}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.284Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [5] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.284Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [5] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.285Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=5, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.285Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [5]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.285Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=5}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.293Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=5}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.294Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.294Z", "log.level":"TRACE", "message":"lag detection for version 5 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.304Z", "log.level": "INFO", "message":"adding index template [.ml-stats] for index patterns [.ml-stats-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.305Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [6] in for node version [8.0.0] with size [964]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.305Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [6] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.306Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.307Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=6, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 6\nstate uuid: j_G8RoQQS82fKD_1WtpNrg\nfrom_diff: false\nmeta data version: 5\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.308Z", "log.level":"TRACE", "message":"sending cluster state diff for version [6] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.309Z", "log.level":"DEBUG", "message":"received diff cluster state version [6] with uuid [j_G8RoQQS82fKD_1WtpNrg], diff size [964]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.311Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=6, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 6\nstate uuid: j_G8RoQQS82fKD_1WtpNrg\nfrom_diff: false\nmeta data version: 5\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.312Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [6] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.312Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.314Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.316Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.409Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.409Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=6}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.409Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.410Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=6}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.410Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [6] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.410Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [6] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.410Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=6, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.410Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.411Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=6}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.419Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=6}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.419Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.420Z", "log.level":"TRACE", "message":"lag detection for version 6 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.425Z", "log.level": "INFO", "message":"adding component template [synthetics-settings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.428Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [7] in for node version [8.0.0] with size [285]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.428Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [7] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.428Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.430Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=7, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 7\nstate uuid: C1gTVqhlQKaWlPAZIkQ7aw\nfrom_diff: false\nmeta data version: 6\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.431Z", "log.level":"TRACE", "message":"sending cluster state diff for version [7] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.433Z", "log.level":"DEBUG", "message":"received diff cluster state version [7] with uuid [C1gTVqhlQKaWlPAZIkQ7aw], diff size [285]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.435Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=7, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 7\nstate uuid: C1gTVqhlQKaWlPAZIkQ7aw\nfrom_diff: false\nmeta data version: 6\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.436Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [7] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.437Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.439Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.442Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.518Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.518Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=7}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.518Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.519Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=7}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.519Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [7] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.519Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [7] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.519Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=7, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.519Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [7]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.520Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=7}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.528Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=7}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.528Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.529Z", "log.level":"TRACE", "message":"lag detection for version 7 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.536Z", "log.level": "INFO", "message":"adding component template [logs-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.537Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [8] in for node version [8.0.0] with size [348]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.537Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [8] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.537Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.539Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=8, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 8\nstate uuid: PkcEBPAkTHOmD_WklXgy9A\nfrom_diff: false\nmeta data version: 7\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.540Z", "log.level":"TRACE", "message":"sending cluster state diff for version [8] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.541Z", "log.level":"DEBUG", "message":"received diff cluster state version [8] with uuid [PkcEBPAkTHOmD_WklXgy9A], diff size [348]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.543Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=8, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 8\nstate uuid: PkcEBPAkTHOmD_WklXgy9A\nfrom_diff: false\nmeta data version: 7\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.544Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [8] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.544Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.546Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.548Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.622Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.622Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=8}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.622Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.622Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=8}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.622Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [8] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.623Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [8] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.623Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=8, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.623Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [8]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.623Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=8}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.632Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=8}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.632Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.633Z", "log.level":"TRACE", "message":"lag detection for version 8 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.637Z", "log.level": "INFO", "message":"adding component template [logs-settings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.637Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [9] in for node version [8.0.0] with size [306]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.638Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [9] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.638Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.639Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=9, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 9\nstate uuid: 49r179cUQnC0LBrUNYC63Q\nfrom_diff: false\nmeta data version: 8\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.640Z", "log.level":"TRACE", "message":"sending cluster state diff for version [9] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.640Z", "log.level":"DEBUG", "message":"received diff cluster state version [9] with uuid [49r179cUQnC0LBrUNYC63Q], diff size [306]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.642Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=9, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 9\nstate uuid: 49r179cUQnC0LBrUNYC63Q\nfrom_diff: false\nmeta data version: 8\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.642Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [9] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.642Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.644Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.645Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.716Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.716Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=9}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.716Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.717Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=9}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.717Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [9] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.717Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [9] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.717Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=9, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.717Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [9]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.717Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=9}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.725Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=9}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.725Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.725Z", "log.level":"TRACE", "message":"lag detection for version 9 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.730Z", "log.level": "INFO", "message":"adding component template [metrics-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.730Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [10] in for node version [8.0.0] with size [353]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.730Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [10] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.731Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.732Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=10, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 10\nstate uuid: LetyYtBlSbC7O2vmK89VZg\nfrom_diff: false\nmeta data version: 9\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.732Z", "log.level":"TRACE", "message":"sending cluster state diff for version [10] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.733Z", "log.level":"DEBUG", "message":"received diff cluster state version [10] with uuid [LetyYtBlSbC7O2vmK89VZg], diff size [353]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.734Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=10, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 10\nstate uuid: LetyYtBlSbC7O2vmK89VZg\nfrom_diff: false\nmeta data version: 9\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.735Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [10] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.735Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.736Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.737Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.788Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.788Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=10}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.789Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.789Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=10}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.789Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [10] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.789Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [10] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.790Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=10, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.790Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [10]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.790Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=10}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.797Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=10}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.797Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.797Z", "log.level":"TRACE", "message":"lag detection for version 10 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.806Z", "log.level": "INFO", "message":"adding component template [data-streams-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.806Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [11] in for node version [8.0.0] with size [516]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.807Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [11] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.807Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.808Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=11, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 11\nstate uuid: COfcLKMkTACYLEF9fVCiBw\nfrom_diff: false\nmeta data version: 10\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.809Z", "log.level":"TRACE", "message":"sending cluster state diff for version [11] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.810Z", "log.level":"DEBUG", "message":"received diff cluster state version [11] with uuid [COfcLKMkTACYLEF9fVCiBw], diff size [516]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.811Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=11, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 11\nstate uuid: COfcLKMkTACYLEF9fVCiBw\nfrom_diff: false\nmeta data version: 10\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.812Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [11] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.812Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.814Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.817Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.887Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.888Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=11}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.888Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.888Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=11}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.888Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [11] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.889Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [11] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.889Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=11, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.889Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [11]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.889Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=11}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.897Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=11}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.897Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.897Z", "log.level":"TRACE", "message":"lag detection for version 11 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.900Z", "log.level": "INFO", "message":"adding component template [metrics-settings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.901Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [12] in for node version [8.0.0] with size [304]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.901Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [12] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.901Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.902Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=12, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 12\nstate uuid: 1d_wWKURS2Kt3QOpT25fOQ\nfrom_diff: false\nmeta data version: 11\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.903Z", "log.level":"TRACE", "message":"sending cluster state diff for version [12] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.903Z", "log.level":"DEBUG", "message":"received diff cluster state version [12] with uuid [1d_wWKURS2Kt3QOpT25fOQ], diff size [304]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.905Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=12, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 12\nstate uuid: 1d_wWKURS2Kt3QOpT25fOQ\nfrom_diff: false\nmeta data version: 11\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.905Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [12] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.905Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.907Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.908Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.976Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.976Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=12}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.976Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.976Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=12}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.976Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [12] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.976Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [12] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.977Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=12, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.977Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [12]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.977Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=12}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.985Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=12}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.985Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.985Z", "log.level":"TRACE", "message":"lag detection for version 12 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.990Z", "log.level": "INFO", "message":"adding component template [synthetics-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.990Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [13] in for node version [8.0.0] with size [355]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.990Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [13] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.990Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.992Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=13, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 13\nstate uuid: gedpOhwATyGU4nJXeG6RqA\nfrom_diff: false\nmeta data version: 12\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.992Z", "log.level":"TRACE", "message":"sending cluster state diff for version [13] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.993Z", "log.level":"DEBUG", "message":"received diff cluster state version [13] with uuid [gedpOhwATyGU4nJXeG6RqA], diff size [355]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.994Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=13, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 13\nstate uuid: gedpOhwATyGU4nJXeG6RqA\nfrom_diff: false\nmeta data version: 12\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\n}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.995Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [13] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.995Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:25.997Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:25.999Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.067Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.067Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=13}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.067Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.067Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=13}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.068Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [13] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.068Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [13] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.068Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=13, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.068Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [13]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.068Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=13}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.076Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=13}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.076Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.076Z", "log.level":"TRACE", "message":"lag detection for version 13 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.077Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [14] in for node version [8.0.0] with size [252]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.077Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [14] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.077Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.079Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=14, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 14\nstate uuid: 1mdbQzd8RnOh-7EuBqhOUQ\nfrom_diff: false\nmeta data version: 12\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.080Z", "log.level":"TRACE", "message":"sending cluster state diff for version [14] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.081Z", "log.level":"DEBUG", "message":"received diff cluster state version [14] with uuid [1mdbQzd8RnOh-7EuBqhOUQ], diff size [252]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.082Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=14, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 14\nstate uuid: 1mdbQzd8RnOh-7EuBqhOUQ\nfrom_diff: false\nmeta data version: 12\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.083Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [14] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.083Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.083Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.166Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.166Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=14}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.166Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.166Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=14}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.167Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [14] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.167Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [14] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.167Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=14, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.167Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [14]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.168Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=14}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.174Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=14}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.175Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.175Z", "log.level":"TRACE", "message":"lag detection for version 14 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.189Z", "log.level": "INFO", "message":"adding index template [.watch-history-14] for index patterns [.watcher-history-14*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.189Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [15] in for node version [8.0.0] with size [1459]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.190Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [15] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.190Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.191Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=15, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 15\nstate uuid: jJ7qs1-aSEuFk49JaRfBCQ\nfrom_diff: false\nmeta data version: 13\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.193Z", "log.level":"TRACE", "message":"sending cluster state diff for version [15] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.193Z", "log.level":"DEBUG", "message":"received diff cluster state version [15] with uuid [jJ7qs1-aSEuFk49JaRfBCQ], diff size [1459]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.196Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=15, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 15\nstate uuid: jJ7qs1-aSEuFk49JaRfBCQ\nfrom_diff: false\nmeta data version: 13\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.197Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [15] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.198Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.200Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.202Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.273Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.273Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=15}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.273Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.274Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=15}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.274Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [15] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.274Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [15] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.274Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=15, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.274Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [15]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.275Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=15}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.283Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=15}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.283Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.284Z", "log.level":"TRACE", "message":"lag detection for version 15 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.290Z", "log.level": "INFO", "message":"adding index template [ilm-history] for index patterns [ilm-history-5*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.290Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [16] in for node version [8.0.0] with size [602]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.290Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [16] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.291Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.293Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=16, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 16\nstate uuid: 2ovvklhWTTyWYqp-vm7JLA\nfrom_diff: false\nmeta data version: 14\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.295Z", "log.level":"TRACE", "message":"sending cluster state diff for version [16] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.295Z", "log.level":"DEBUG", "message":"received diff cluster state version [16] with uuid [2ovvklhWTTyWYqp-vm7JLA], diff size [602]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.298Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=16, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 16\nstate uuid: 2ovvklhWTTyWYqp-vm7JLA\nfrom_diff: false\nmeta data version: 14\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.299Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [16] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.299Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.301Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.302Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.396Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.396Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=16}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.397Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.397Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=16}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.397Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [16] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.397Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [16] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.398Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=16, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.398Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [16]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.398Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=16}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.405Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=16}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.406Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.406Z", "log.level":"TRACE", "message":"lag detection for version 16 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.412Z", "log.level": "INFO", "message":"adding index template [.slm-history] for index patterns [.slm-history-5*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.412Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [17] in for node version [8.0.0] with size [566]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.412Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [17] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.413Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.414Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=17, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 17\nstate uuid: JPajyBjcRS2wx-ddGMwMjQ\nfrom_diff: false\nmeta data version: 15\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.417Z", "log.level":"TRACE", "message":"sending cluster state diff for version [17] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.417Z", "log.level":"DEBUG", "message":"received diff cluster state version [17] with uuid [JPajyBjcRS2wx-ddGMwMjQ], diff size [566]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.419Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=17, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 17\nstate uuid: JPajyBjcRS2wx-ddGMwMjQ\nfrom_diff: false\nmeta data version: 15\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.421Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [17] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.421Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.423Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.425Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.497Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.497Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=17}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=17}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [17] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [17] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=17, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [17]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.498Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=17}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.505Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=17}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.505Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.505Z", "log.level":"TRACE", "message":"lag detection for version 17 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.508Z", "log.level": "INFO", "message":"adding component template [.deprecation-indexing-settings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.508Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [18] in for node version [8.0.0] with size [325]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.509Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [18] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.509Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.510Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=18, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 18\nstate uuid: hYSS4REsTHGFe4AVVAnang\nfrom_diff: false\nmeta data version: 16\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.512Z", "log.level":"TRACE", "message":"sending cluster state diff for version [18] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.512Z", "log.level":"DEBUG", "message":"received diff cluster state version [18] with uuid [hYSS4REsTHGFe4AVVAnang], diff size [325]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.515Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=18, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 18\nstate uuid: hYSS4REsTHGFe4AVVAnang\nfrom_diff: false\nmeta data version: 16\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.516Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [18] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.516Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.517Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.519Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.589Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.589Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=18}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.590Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.590Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=18}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.590Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [18] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.590Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [18] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.590Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=18, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.591Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [18]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.591Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=18}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.599Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=18}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.599Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.599Z", "log.level":"TRACE", "message":"lag detection for version 18 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.604Z", "log.level": "INFO", "message":"adding component template [.deprecation-indexing-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.605Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [19] in for node version [8.0.0] with size [533]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.605Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [19] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.605Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.607Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=19, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 19\nstate uuid: W_oR7Cq_RYum8M2nqUB0DA\nfrom_diff: false\nmeta data version: 17\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.608Z", "log.level":"TRACE", "message":"sending cluster state diff for version [19] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.609Z", "log.level":"DEBUG", "message":"received diff cluster state version [19] with uuid [W_oR7Cq_RYum8M2nqUB0DA], diff size [533]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.611Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=19, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 19\nstate uuid: W_oR7Cq_RYum8M2nqUB0DA\nfrom_diff: false\nmeta data version: 17\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.612Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [19] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.612Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.614Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.616Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.693Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.693Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=19}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.694Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.694Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=19}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.694Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [19] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.694Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [19] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.694Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=19, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.695Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [19]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.695Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=19}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.702Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=19}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.702Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.702Z", "log.level":"TRACE", "message":"lag detection for version 19 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.707Z", "log.level": "INFO", "message":"adding template [.monitoring-alerts-7] for index patterns [.monitoring-alerts-7]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.707Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [20] in for node version [8.0.0] with size [465]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.707Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [20] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.707Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.709Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=20, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 20\nstate uuid: EKfIu5zKQm2WHsLAf4V0gQ\nfrom_diff: false\nmeta data version: 18\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.710Z", "log.level":"TRACE", "message":"sending cluster state diff for version [20] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.711Z", "log.level":"DEBUG", "message":"received diff cluster state version [20] with uuid [EKfIu5zKQm2WHsLAf4V0gQ], diff size [465]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.713Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=20, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 20\nstate uuid: EKfIu5zKQm2WHsLAf4V0gQ\nfrom_diff: false\nmeta data version: 18\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.716Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [20] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.716Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.718Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.720Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.791Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.791Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=20}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.791Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.791Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=20}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.792Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [20] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.792Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [20] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.792Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=20, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.792Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [20]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.792Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=20}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.800Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=20}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.800Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.800Z", "log.level":"TRACE", "message":"lag detection for version 20 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.814Z", "log.level": "INFO", "message":"adding template [.monitoring-es] for index patterns [.monitoring-es-7-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.814Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [21] in for node version [8.0.0] with size [2244]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.814Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [21] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.815Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.816Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=21, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 21\nstate uuid: qCbCzXnTSfqun8DsvY3Y5A\nfrom_diff: false\nmeta data version: 19\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.817Z", "log.level":"TRACE", "message":"sending cluster state diff for version [21] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.818Z", "log.level":"DEBUG", "message":"received diff cluster state version [21] with uuid [qCbCzXnTSfqun8DsvY3Y5A], diff size [2244]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.819Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=21, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 21\nstate uuid: qCbCzXnTSfqun8DsvY3Y5A\nfrom_diff: false\nmeta data version: 19\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.820Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [21] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.820Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.823Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [18730]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.824Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.825Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.909Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=21}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=21}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [21] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [21] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=21, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.910Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [21]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.911Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=21}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.917Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=21}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.917Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.917Z", "log.level":"TRACE", "message":"lag detection for version 21 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.923Z", "log.level": "INFO", "message":"adding template [.monitoring-kibana] for index patterns [.monitoring-kibana-7-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.923Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [22] in for node version [8.0.0] with size [827]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.924Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [22] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.924Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.926Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=22, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 22\nstate uuid: zacxcUalR6ydf1lW04XsuQ\nfrom_diff: false\nmeta data version: 20\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.927Z", "log.level":"TRACE", "message":"sending cluster state diff for version [22] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.928Z", "log.level":"DEBUG", "message":"received diff cluster state version [22] with uuid [zacxcUalR6ydf1lW04XsuQ], diff size [827]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.930Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=22, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 22\nstate uuid: zacxcUalR6ydf1lW04XsuQ\nfrom_diff: false\nmeta data version: 20\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.932Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [22] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.932Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:26.934Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:26.936Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.005Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.005Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=22}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.005Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.005Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=22}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.005Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [22] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.005Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [22] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.006Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=22, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.006Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [22]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.006Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=22}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.013Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=22}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.013Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.013Z", "log.level":"TRACE", "message":"lag detection for version 22 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.019Z", "log.level": "INFO", "message":"adding template [.monitoring-logstash] for index patterns [.monitoring-logstash-7-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.020Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [23] in for node version [8.0.0] with size [1121]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.020Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [23] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.020Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.021Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=23, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 23\nstate uuid: scazcNmhSruWVejUV89K5Q\nfrom_diff: false\nmeta data version: 21\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.022Z", "log.level":"TRACE", "message":"sending cluster state diff for version [23] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.023Z", "log.level":"DEBUG", "message":"received diff cluster state version [23] with uuid [scazcNmhSruWVejUV89K5Q], diff size [1121]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.024Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=23, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 23\nstate uuid: scazcNmhSruWVejUV89K5Q\nfrom_diff: false\nmeta data version: 21\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.025Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [23] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.026Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.028Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.030Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.099Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.099Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=23}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.099Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.099Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=23}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.099Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [23] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.099Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [23] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.100Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=23, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.100Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [23]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.100Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=23}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.110Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=23}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.110Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.110Z", "log.level":"TRACE", "message":"lag detection for version 23 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.126Z", "log.level": "INFO", "message":"adding template [.monitoring-beats] for index patterns [.monitoring-beats-7-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.126Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [24] in for node version [8.0.0] with size [1568]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.127Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [24] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.127Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.129Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=24, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 24\nstate uuid: LEjTYVHxSsu_cqDn5xxY2g\nfrom_diff: false\nmeta data version: 22\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.131Z", "log.level":"TRACE", "message":"sending cluster state diff for version [24] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.132Z", "log.level":"DEBUG", "message":"received diff cluster state version [24] with uuid [LEjTYVHxSsu_cqDn5xxY2g], diff size [1568]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.134Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=24, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 24\nstate uuid: LEjTYVHxSsu_cqDn5xxY2g\nfrom_diff: false\nmeta data version: 22\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 1):\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.136Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [24] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.136Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.139Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.141Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.214Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.215Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=24}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.215Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.215Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=24}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.215Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [24] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.215Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [24] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.216Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=24, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.216Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [24]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.216Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=24}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.224Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=24}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.224Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.224Z", "log.level":"TRACE", "message":"lag detection for version 24 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.271Z", "log.level": "INFO", "message":"[.security-7] creating index, cause [api], templates [], shards [1]/[0]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.289Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [25] in for node version [8.0.0] with size [1367]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.289Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [25] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.290Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.293Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=25, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 25\nstate uuid: KctZkmvtQSmVhykrSyfdGQ\nfrom_diff: false\nmeta data version: 23\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.294Z", "log.level":"TRACE", "message":"sending cluster state diff for version [25] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.296Z", "log.level":"DEBUG", "message":"received diff cluster state version [25] with uuid [KctZkmvtQSmVhykrSyfdGQ], diff size [1367]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.298Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=25, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 25\nstate uuid: KctZkmvtQSmVhykrSyfdGQ\nfrom_diff: false\nmeta data version: 23\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.299Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [25] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.299Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.299Z", "log.level":"TRACE", "message":"updating metadata for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]], changing version from [null] to [2]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.301Z", "log.level":"TRACE", "message":"updating metadata for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.302Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.373Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.374Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=25}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.374Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.374Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=25}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.374Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [25] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.374Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [25] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.375Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=25, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.375Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [25]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.375Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=25}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.496Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=25}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.513Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.513Z", "log.level":"TRACE", "message":"lag detection for version 25 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.527Z", "log.level": "INFO", "message":"adding index template [logs] for index patterns [logs-*-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.533Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [26] in for node version [8.0.0] with size [261]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.533Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [26] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.551Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.553Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=26, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 26\nstate uuid: bvXmJ7QoSkCBDnMy5VE1GQ\nfrom_diff: false\nmeta data version: 24\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.554Z", "log.level":"TRACE", "message":"sending cluster state diff for version [26] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.555Z", "log.level":"DEBUG", "message":"received diff cluster state version [26] with uuid [bvXmJ7QoSkCBDnMy5VE1GQ], diff size [261]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.557Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=26, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 26\nstate uuid: bvXmJ7QoSkCBDnMy5VE1GQ\nfrom_diff: false\nmeta data version: 24\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.558Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [26] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.558Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.561Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [24785]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.561Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.585Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.586Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.816Z", "log.level":"DEBUG", "message":"writing cluster state took [400ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.816Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=26}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.816Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.816Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=26}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.817Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [26] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.817Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [26] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.817Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=26, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.817Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [26]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.818Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=26}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.850Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=26}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.850Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.850Z", "log.level":"TRACE", "message":"lag detection for version 26 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.856Z", "log.level": "INFO", "message":"adding index template [metrics] for index patterns [metrics-*-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.857Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [27] in for node version [8.0.0] with size [266]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.857Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [27] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.857Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.860Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=27, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 27\nstate uuid: ptWFeo9QTGCvVV6BWoj2PQ\nfrom_diff: false\nmeta data version: 25\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.879Z", "log.level":"TRACE", "message":"sending cluster state diff for version [27] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.880Z", "log.level":"DEBUG", "message":"received diff cluster state version [27] with uuid [ptWFeo9QTGCvVV6BWoj2PQ], diff size [266]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.900Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=27, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 27\nstate uuid: ptWFeo9QTGCvVV6BWoj2PQ\nfrom_diff: false\nmeta data version: 25\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.918Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [27] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.936Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.956Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:27.958Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:27.958Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.087Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.088Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=27}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.088Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.088Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=27}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.088Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [27] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.088Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [27] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.089Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=27, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.089Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [27]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.089Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=27}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.097Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=27}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.098Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.098Z", "log.level":"TRACE", "message":"lag detection for version 27 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.103Z", "log.level": "INFO", "message":"adding index template [synthetics] for index patterns [synthetics-*-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.103Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [28] in for node version [8.0.0] with size [268]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.103Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [28] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.104Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.105Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=28, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 28\nstate uuid: d1CbyGttSjuCRncuyNujyw\nfrom_diff: false\nmeta data version: 26\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.107Z", "log.level":"TRACE", "message":"sending cluster state diff for version [28] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.108Z", "log.level":"DEBUG", "message":"received diff cluster state version [28] with uuid [d1CbyGttSjuCRncuyNujyw], diff size [268]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.110Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=28, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 28\nstate uuid: d1CbyGttSjuCRncuyNujyw\nfrom_diff: false\nmeta data version: 26\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.111Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [28] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.111Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.114Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.115Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.115Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.187Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.187Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=28}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.187Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.187Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=28}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.187Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [28] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.187Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [28] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.188Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=28, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.188Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [28]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.188Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=28}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.195Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=28}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.196Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.196Z", "log.level":"TRACE", "message":"lag detection for version 28 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.200Z", "log.level": "INFO", "message":"adding index template [.deprecation-indexing-template] for index patterns [.logs-deprecation.*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.200Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [29] in for node version [8.0.0] with size [284]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.201Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [29] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.201Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.202Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=29, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 29\nstate uuid: K59dPWg-RN2HnXhQ7RwI1Q\nfrom_diff: false\nmeta data version: 27\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.203Z", "log.level":"TRACE", "message":"sending cluster state diff for version [29] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.204Z", "log.level":"DEBUG", "message":"received diff cluster state version [29] with uuid [K59dPWg-RN2HnXhQ7RwI1Q], diff size [284]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.206Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=29, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 29\nstate uuid: K59dPWg-RN2HnXhQ7RwI1Q\nfrom_diff: false\nmeta data version: 27\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 2):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=vBO-kiOPSAuujh0zkCtYag], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:27.274Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.207Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [29] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.207Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.209Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.211Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.211Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.281Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.281Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=29}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.281Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.281Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=29}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.281Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [29] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.281Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [29] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.282Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=29, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.282Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [29]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.282Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=29}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.290Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=29}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.290Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.290Z", "log.level":"TRACE", "message":"lag detection for version 29 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.293Z", "log.level": "INFO",  "current.health":"GREEN", "message":"Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.security-7][0]]]).", "previous.health":"YELLOW", "reason":"shards started [[.security-7][0]]" , "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.297Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [30] in for node version [8.0.0] with size [581]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.297Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [30] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.297Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.299Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=30, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 30\nstate uuid: R3dt4eiIRkGknukRLQ-GSA\nfrom_diff: false\nmeta data version: 28\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.300Z", "log.level":"TRACE", "message":"sending cluster state diff for version [30] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.301Z", "log.level":"DEBUG", "message":"received diff cluster state version [30] with uuid [R3dt4eiIRkGknukRLQ-GSA], diff size [581]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.303Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=30, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 30\nstate uuid: R3dt4eiIRkGknukRLQ-GSA\nfrom_diff: false\nmeta data version: 28\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.305Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [30] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.305Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.305Z", "log.level":"TRACE", "message":"updating metadata for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]], changing version from [2] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.305Z", "log.level":"TRACE", "message":"updating metadata for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.307Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.377Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [0] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.377Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=30}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.377Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.377Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=30}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.377Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [30] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.378Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [30] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.378Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=30, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.378Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [30]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.378Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=30}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.392Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=30}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.400Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.400Z", "log.level":"TRACE", "message":"lag detection for version 30 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.404Z", "log.level": "INFO", "message":"adding index lifecycle policy [ml-size-based-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.421Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [31] in for node version [8.0.0] with size [378]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.421Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [31] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.421Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.424Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=31, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 31\nstate uuid: NnALlKZERt2E7XRmXAeIug\nfrom_diff: false\nmeta data version: 29\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.434Z", "log.level":"TRACE", "message":"sending cluster state diff for version [31] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.436Z", "log.level":"DEBUG", "message":"received diff cluster state version [31] with uuid [NnALlKZERt2E7XRmXAeIug], diff size [378]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.440Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=31, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 31\nstate uuid: NnALlKZERt2E7XRmXAeIug\nfrom_diff: false\nmeta data version: 29\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.443Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [31] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.443Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.448Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [25742]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.448Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.450Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.451Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.596Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.596Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=31}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.596Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.596Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=31}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.597Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [31] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.597Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [31] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.597Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=31, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.597Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [31]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.597Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=31}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.613Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=31}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.613Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.613Z", "log.level":"TRACE", "message":"lag detection for version 31 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.613Z", "log.level": "INFO", "message":"adding index lifecycle policy [synthetics]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.614Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [32] in for node version [8.0.0] with size [374]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.614Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [32] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.614Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.616Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=32, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 32\nstate uuid: B7u4s9MKRkKAmG3IAJv_2Q\nfrom_diff: false\nmeta data version: 30\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.618Z", "log.level":"TRACE", "message":"sending cluster state diff for version [32] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.619Z", "log.level":"DEBUG", "message":"received diff cluster state version [32] with uuid [B7u4s9MKRkKAmG3IAJv_2Q], diff size [374]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.621Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=32, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 32\nstate uuid: B7u4s9MKRkKAmG3IAJv_2Q\nfrom_diff: false\nmeta data version: 30\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.623Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [32] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.623Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.625Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.627Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.627Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.698Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.699Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=32}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.699Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.699Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=32}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.699Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [32] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.699Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [32] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.699Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=32, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.700Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [32]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.700Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=32}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.709Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=32}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.709Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.709Z", "log.level":"TRACE", "message":"lag detection for version 32 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.710Z", "log.level": "INFO", "message":"adding index lifecycle policy [metrics]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.711Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [33] in for node version [8.0.0] with size [370]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.711Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [33] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.711Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.713Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=33, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 33\nstate uuid: senab5rtQWetyU3-ZZqAEw\nfrom_diff: false\nmeta data version: 31\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.715Z", "log.level":"TRACE", "message":"sending cluster state diff for version [33] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.716Z", "log.level":"DEBUG", "message":"received diff cluster state version [33] with uuid [senab5rtQWetyU3-ZZqAEw], diff size [370]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.717Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=33, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 33\nstate uuid: senab5rtQWetyU3-ZZqAEw\nfrom_diff: false\nmeta data version: 31\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.720Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [33] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.720Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.723Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.725Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.725Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=33}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=33}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [33] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [33] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.832Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=33, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.833Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [33]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.833Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=33}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.841Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=33}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.841Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.841Z", "log.level":"TRACE", "message":"lag detection for version 33 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.842Z", "log.level": "INFO", "message":"adding index lifecycle policy [logs]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.842Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [34] in for node version [8.0.0] with size [370]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.842Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [34] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.843Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.844Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=34, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 34\nstate uuid: YMJA1HQhSOy6L3fLM4Qx2A\nfrom_diff: false\nmeta data version: 32\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.847Z", "log.level":"TRACE", "message":"sending cluster state diff for version [34] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.847Z", "log.level":"DEBUG", "message":"received diff cluster state version [34] with uuid [YMJA1HQhSOy6L3fLM4Qx2A], diff size [370]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.849Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=34, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 34\nstate uuid: YMJA1HQhSOy6L3fLM4Qx2A\nfrom_diff: false\nmeta data version: 32\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.851Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [34] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.851Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.854Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.856Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.856Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.973Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.973Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=34}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.973Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.973Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=34}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.973Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [34] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.973Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [34] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.974Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=34, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.974Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [34]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.974Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=34}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.982Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=34}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.983Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.983Z", "log.level":"TRACE", "message":"lag detection for version 34 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.983Z", "log.level": "INFO", "message":"adding index lifecycle policy [watch-history-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.984Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [35] in for node version [8.0.0] with size [363]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.984Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [35] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.984Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.986Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=35, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 35\nstate uuid: M6wWxYlPQvul9yNgBZkSNg\nfrom_diff: false\nmeta data version: 33\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.988Z", "log.level":"TRACE", "message":"sending cluster state diff for version [35] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.989Z", "log.level":"DEBUG", "message":"received diff cluster state version [35] with uuid [M6wWxYlPQvul9yNgBZkSNg], diff size [363]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.991Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=35, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 35\nstate uuid: M6wWxYlPQvul9yNgBZkSNg\nfrom_diff: false\nmeta data version: 33\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.993Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [35] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.993Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.996Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:28.998Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:28.998Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.189Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.189Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=35}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.189Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.190Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=35}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.190Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [35] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.190Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [35] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.190Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=35, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.190Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [35]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.190Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=35}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.199Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=35}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.199Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.199Z", "log.level":"TRACE", "message":"lag detection for version 35 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.200Z", "log.level": "INFO", "message":"adding index lifecycle policy [ilm-history-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.200Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [36] in for node version [8.0.0] with size [386]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.200Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [36] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.201Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.202Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=36, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 36\nstate uuid: 76B0_c8RSXuSA8cNDRJ03w\nfrom_diff: false\nmeta data version: 34\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.204Z", "log.level":"TRACE", "message":"sending cluster state diff for version [36] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.205Z", "log.level":"DEBUG", "message":"received diff cluster state version [36] with uuid [76B0_c8RSXuSA8cNDRJ03w], diff size [386]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.207Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=36, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 36\nstate uuid: 76B0_c8RSXuSA8cNDRJ03w\nfrom_diff: false\nmeta data version: 34\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.210Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [36] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.210Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.213Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.232Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.233Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.301Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.301Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=36}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=36}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [36] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [36] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=36, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [36]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.302Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=36}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.309Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=36}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.310Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.310Z", "log.level":"TRACE", "message":"lag detection for version 36 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.310Z", "log.level": "INFO", "message":"adding index lifecycle policy [slm-history-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.311Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [37] in for node version [8.0.0] with size [390]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.311Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [37] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.311Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.313Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=37, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 37\nstate uuid: LcPaMbtkT-GWda8odlHY5Q\nfrom_diff: false\nmeta data version: 35\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.315Z", "log.level":"TRACE", "message":"sending cluster state diff for version [37] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.316Z", "log.level":"DEBUG", "message":"received diff cluster state version [37] with uuid [LcPaMbtkT-GWda8odlHY5Q], diff size [390]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.318Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=37, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 37\nstate uuid: LcPaMbtkT-GWda8odlHY5Q\nfrom_diff: false\nmeta data version: 35\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.321Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [37] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.321Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.324Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.325Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.325Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.415Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=37}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=37}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [37] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [37] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=37, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.416Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [37]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.417Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=37}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.423Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=37}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.424Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.424Z", "log.level":"TRACE", "message":"lag detection for version 37 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.424Z", "log.level": "INFO", "message":"adding index lifecycle policy [.deprecation-indexing-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.425Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [38] in for node version [8.0.0] with size [334]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.425Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [38] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.425Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.427Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=38, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 38\nstate uuid: cuJMM-ywT_CH_3i1FKiCiA\nfrom_diff: false\nmeta data version: 36\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.428Z", "log.level":"TRACE", "message":"sending cluster state diff for version [38] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.429Z", "log.level":"DEBUG", "message":"received diff cluster state version [38] with uuid [cuJMM-ywT_CH_3i1FKiCiA], diff size [334]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.431Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=38, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 38\nstate uuid: cuJMM-ywT_CH_3i1FKiCiA\nfrom_diff: false\nmeta data version: 36\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.433Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [38] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.433Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.435Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.437Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.437Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.525Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.525Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=38}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.526Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.526Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=38}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.526Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [38] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.526Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [38] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.526Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=38, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.526Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [38]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.527Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=38}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.534Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=38}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.534Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.534Z", "log.level":"TRACE", "message":"lag detection for version 38 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.534Z", "log.level": "INFO", "message":"adding index lifecycle policy [.fleet-actions-results-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.535Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [39] in for node version [8.0.0] with size [398]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.535Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [39] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.535Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.537Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=39, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 39\nstate uuid: zIPxuiv4T0K1BKUijebeQQ\nfrom_diff: false\nmeta data version: 37\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.540Z", "log.level":"TRACE", "message":"sending cluster state diff for version [39] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.540Z", "log.level":"DEBUG", "message":"received diff cluster state version [39] with uuid [zIPxuiv4T0K1BKUijebeQQ], diff size [398]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.542Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=39, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 39\nstate uuid: zIPxuiv4T0K1BKUijebeQQ\nfrom_diff: false\nmeta data version: 37\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.544Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [39] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.544Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.548Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.550Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.550Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.622Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.622Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=39}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.622Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.622Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=39}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.623Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [39] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.623Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [39] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.623Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=39, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.623Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [39]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.623Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=39}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.631Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=39}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.631Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.631Z", "log.level":"TRACE", "message":"lag detection for version 39 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.649Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [40] in for node version [8.0.0] with size [545]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.649Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [40] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.650Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.651Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=40, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 40\nstate uuid: PIF1uewlTey4KqLeNh3scQ\nfrom_diff: false\nmeta data version: 38\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.653Z", "log.level":"TRACE", "message":"sending cluster state diff for version [40] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.653Z", "log.level":"DEBUG", "message":"received diff cluster state version [40] with uuid [PIF1uewlTey4KqLeNh3scQ], diff size [545]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.655Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=40, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 40\nstate uuid: PIF1uewlTey4KqLeNh3scQ\nfrom_diff: false\nmeta data version: 38\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.657Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [40] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.657Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.660Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.662Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.662Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.719Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.719Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=40}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.719Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.720Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=40}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.720Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [40] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.720Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [40] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.720Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=40, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.720Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [40]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.720Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=40}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.741Z", "log.level": "INFO", "message":"license [29791a63-4252-4665-b3b4-471b34127370] mode [trial] - valid", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.license.LicenseService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.741Z", "log.level": "INFO", "message":"license mode is [trial], currently licensed security realms are [reserved/reserved,file/default_file,native/default_native]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.security.authc.Realms","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.742Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=40}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.742Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.743Z", "log.level":"TRACE", "message":"lag detection for version 40 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.744Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [41] in for node version [8.0.0] with size [292]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.745Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [41] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.745Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.747Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=41, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 41\nstate uuid: 2LuV_GM6RU-xP7R9uzTyTQ\nfrom_diff: false\nmeta data version: 39\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@39879c4a   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.749Z", "log.level":"TRACE", "message":"sending cluster state diff for version [41] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.750Z", "log.level":"DEBUG", "message":"received diff cluster state version [41] with uuid [2LuV_GM6RU-xP7R9uzTyTQ], diff size [292]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.751Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=41, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 41\nstate uuid: 2LuV_GM6RU-xP7R9uzTyTQ\nfrom_diff: false\nmeta data version: 39\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@39879c4a   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.754Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [41] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.755Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.758Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.759Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.759Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.831Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.831Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=41}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.831Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.831Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=41}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.831Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [41] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.832Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [41] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.832Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=41, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.832Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [41]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.832Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=41}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.840Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=41}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.841Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.841Z", "log.level":"TRACE", "message":"lag detection for version 41 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.842Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [42] in for node version [8.0.0] with size [420]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.842Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [42] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.842Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.844Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=42, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 42\nstate uuid: oSljve7UT2CPjPsknuTGiA\nfrom_diff: false\nmeta data version: 40\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.847Z", "log.level":"TRACE", "message":"sending cluster state diff for version [42] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.848Z", "log.level":"DEBUG", "message":"received diff cluster state version [42] with uuid [oSljve7UT2CPjPsknuTGiA], diff size [420]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.850Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=42, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 42\nstate uuid: oSljve7UT2CPjPsknuTGiA\nfrom_diff: false\nmeta data version: 40\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 3):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.851Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [42] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.852Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.854Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.856Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.856Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:29.935Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.935Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=42}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.936Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.936Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=42}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.936Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [42] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.936Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [42] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.937Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=42, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.937Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [42]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.937Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=42}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.953Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=42}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.953Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:29.953Z", "log.level":"TRACE", "message":"lag detection for version 42 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.526Z", "log.level": "INFO", "message":"[.kibana_task_manager_8.0.0_001] creating index, cause [api], templates [], shards [1]/[1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.527Z", "log.level": "INFO", "message":"updating number_of_replicas to [0] for indices [.kibana_task_manager_8.0.0_001]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.528Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [43] in for node version [8.0.0] with size [1023]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.529Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [43] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.529Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.532Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=43, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 43\nstate uuid: 1m4Rr1wxRX207UM5IZwrXA\nfrom_diff: false\nmeta data version: 41\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 4):\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.534Z", "log.level":"TRACE", "message":"sending cluster state diff for version [43] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.535Z", "log.level":"DEBUG", "message":"received diff cluster state version [43] with uuid [1m4Rr1wxRX207UM5IZwrXA], diff size [1023]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.537Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=43, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 43\nstate uuid: 1m4Rr1wxRX207UM5IZwrXA\nfrom_diff: false\nmeta data version: 41\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 4):\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.539Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [43] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.539Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.539Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]], changing version from [null] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.539Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:30.541Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.541Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:30.609Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [1] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.609Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=43}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.609Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.610Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=43}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.610Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [43] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.610Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [43] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.610Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=43, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.610Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [43]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.611Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=43}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.704Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=43}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.718Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.718Z", "log.level":"TRACE", "message":"lag detection for version 43 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.741Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001] creating index, cause [api], templates [], shards [1]/[1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.758Z", "log.level": "INFO", "message":"updating number_of_replicas to [0] for indices [.kibana_8.0.0_001]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.760Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [44] in for node version [8.0.0] with size [7816]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.777Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [44] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.778Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.781Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=44, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 44\nstate uuid: Rl7Oss7XQ-OUy3TOqIkeRg\nfrom_diff: false\nmeta data version: 42\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 5):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.798Z", "log.level":"TRACE", "message":"sending cluster state diff for version [44] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.817Z", "log.level":"DEBUG", "message":"received diff cluster state version [44] with uuid [Rl7Oss7XQ-OUy3TOqIkeRg], diff size [7816]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.819Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=44, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 44\nstate uuid: Rl7Oss7XQ-OUy3TOqIkeRg\nfrom_diff: false\nmeta data version: 42\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 5):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=E1wQpniMQ6WDOv0ZR3XKxQ], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.526Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.836Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [44] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.836Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.836Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [null] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.836Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:30.875Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.876Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:30.876Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.041Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [false] and metadata for [1] indices and skipped [2] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.041Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=44}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.060Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.060Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=44}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.061Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [44] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.061Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [44] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.061Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=44, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.062Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [44]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.062Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=44}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.155Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=44}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.166Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.167Z", "log.level":"TRACE", "message":"lag detection for version 44 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.168Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [45] in for node version [8.0.0] with size [442]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.185Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [45] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.186Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.188Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=45, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 45\nstate uuid: xiHXWVEBQ2m7GryuC1_BeQ\nfrom_diff: false\nmeta data version: 43\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 6):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.205Z", "log.level":"TRACE", "message":"sending cluster state diff for version [45] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.205Z", "log.level":"DEBUG", "message":"received diff cluster state version [45] with uuid [xiHXWVEBQ2m7GryuC1_BeQ], diff size [442]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.207Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=45, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 45\nstate uuid: xiHXWVEBQ2m7GryuC1_BeQ\nfrom_diff: false\nmeta data version: 43\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 6):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.225Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [45] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.225Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.225Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.225Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]], changing version from [4] to [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.225Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.264Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.265Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.559Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [false] and metadata for [1] indices and skipped [2] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.559Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=45}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.559Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.559Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=45}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.559Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [45] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.559Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [45] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.560Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=45, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.560Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [45]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.560Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=45}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.579Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=45}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.584Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.603Z", "log.level":"TRACE", "message":"lag detection for version 45 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.623Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [46] in for node version [8.0.0] with size [419]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.641Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [46] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.641Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.643Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=46, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 46\nstate uuid: cBfD1NyDRhCf7dMJQfM9ww\nfrom_diff: false\nmeta data version: 44\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 6):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.650Z", "log.level":"TRACE", "message":"sending cluster state diff for version [46] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.651Z", "log.level":"DEBUG", "message":"received diff cluster state version [46] with uuid [cBfD1NyDRhCf7dMJQfM9ww], diff size [419]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.653Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=46, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 46\nstate uuid: cBfD1NyDRhCf7dMJQfM9ww\nfrom_diff: false\nmeta data version: 44\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 6):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=TywZMX4NQEyZpp8vWhBIvA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:30.757Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.655Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [46] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.656Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.656Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.656Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]], changing version from [6] to [9]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.656Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.657Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.658Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.729Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [2] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.729Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=46}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.729Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.729Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=46}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.729Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [46] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.729Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [46] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.730Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=46, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.730Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [46]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.730Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=46}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.737Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=46}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.750Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.751Z", "log.level":"TRACE", "message":"lag detection for version 46 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.752Z", "log.level": "INFO",  "current.health":"GREEN", "message":"Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.kibana_8.0.0_001][0]]]).", "previous.health":"YELLOW", "reason":"shards started [[.kibana_8.0.0_001][0]]" , "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.770Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [47] in for node version [8.0.0] with size [431]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.770Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [47] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.771Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.772Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=47, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 47\nstate uuid: dwwobrx3Q7mKrFA7vx2Uig\nfrom_diff: false\nmeta data version: 45\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.775Z", "log.level":"TRACE", "message":"sending cluster state diff for version [47] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.776Z", "log.level":"DEBUG", "message":"received diff cluster state version [47] with uuid [dwwobrx3Q7mKrFA7vx2Uig], diff size [431]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.777Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=47, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 47\nstate uuid: dwwobrx3Q7mKrFA7vx2Uig\nfrom_diff: false\nmeta data version: 45\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.781Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [47] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.781Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.781Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [4] to [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.781Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.783Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.783Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.783Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.855Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [false] and metadata for [1] indices and skipped [2] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.855Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=47}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.855Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.855Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=47}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.855Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [47] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.855Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [47] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.856Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=47, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.856Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [47]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.856Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=47}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.864Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=47}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.876Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.877Z", "log.level":"TRACE", "message":"lag detection for version 47 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.878Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [48] in for node version [8.0.0] with size [404]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.894Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [48] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.895Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.897Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=48, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 48\nstate uuid: CU_3B8zOQxSbPDF4pL12ZQ\nfrom_diff: false\nmeta data version: 46\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.900Z", "log.level":"TRACE", "message":"sending cluster state diff for version [48] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.901Z", "log.level":"DEBUG", "message":"received diff cluster state version [48] with uuid [CU_3B8zOQxSbPDF4pL12ZQ], diff size [404]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.903Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=48, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 48\nstate uuid: CU_3B8zOQxSbPDF4pL12ZQ\nfrom_diff: false\nmeta data version: 46\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.906Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [48] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.906Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.906Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [6] to [9]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.907Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.908Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.908Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.908Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:31.979Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [2] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.979Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=48}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.979Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.979Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=48}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.979Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [48] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.980Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [48] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.980Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=48, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.980Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [48]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.980Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=48}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:31.987Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=48}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:32.001Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:32.001Z", "log.level":"TRACE", "message":"lag detection for version 48 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.168Z", "log.level": "INFO", "message":"adding index lifecycle policy [.alerts-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.170Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [49] in for node version [8.0.0] with size [359]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.170Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [49] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.170Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.173Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=49, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 49\nstate uuid: MJTxT7aMQjerlcqM_ICw6Q\nfrom_diff: false\nmeta data version: 47\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.199Z", "log.level":"TRACE", "message":"sending cluster state diff for version [49] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.219Z", "log.level":"DEBUG", "message":"received diff cluster state version [49] with uuid [MJTxT7aMQjerlcqM_ICw6Q], diff size [359]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.239Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=49, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 49\nstate uuid: MJTxT7aMQjerlcqM_ICw6Q\nfrom_diff: false\nmeta data version: 47\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.255Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [49] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.256Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.260Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [29191]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.275Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:34.295Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.295Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.295Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.295Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:34.695Z", "log.level":"DEBUG", "message":"writing cluster state took [405ms]; wrote global metadata [true] and metadata for [0] indices and skipped [3] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.695Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=49}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.696Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.696Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=49}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.696Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [49] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.696Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [49] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.697Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=49, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.697Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [49]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.697Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=49}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.710Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=49}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.710Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.710Z", "log.level":"TRACE", "message":"lag detection for version 49 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.748Z", "log.level": "INFO", "message":"adding component template [.alerts-ecs-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.749Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [50] in for node version [8.0.0] with size [3189]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.749Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [50] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.749Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.755Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=50, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 50\nstate uuid: dCREgPNOSzSCMSAeLeNCQQ\nfrom_diff: false\nmeta data version: 48\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.765Z", "log.level":"TRACE", "message":"sending cluster state diff for version [50] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.767Z", "log.level":"DEBUG", "message":"received diff cluster state version [50] with uuid [dCREgPNOSzSCMSAeLeNCQQ], diff size [3189]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.772Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=50, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 50\nstate uuid: dCREgPNOSzSCMSAeLeNCQQ\nfrom_diff: false\nmeta data version: 48\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.818Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [50] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.818Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.825Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:34.830Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.830Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.830Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:34.831Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:35.181Z", "log.level":"DEBUG", "message":"writing cluster state took [405ms]; wrote global metadata [true] and metadata for [0] indices and skipped [3] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.181Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=50}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.182Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.182Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=50}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.182Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [50] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.182Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [50] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.182Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=50, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.183Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [50]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.183Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=50}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.193Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=50}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.194Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.194Z", "log.level":"TRACE", "message":"lag detection for version 50 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.200Z", "log.level": "INFO", "message":"adding component template [.alerts-technical-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.201Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [51] in for node version [8.0.0] with size [750]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.201Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [51] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.201Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.204Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=51, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 51\nstate uuid: gZ5-BTobSlGTRacPwti5Aw\nfrom_diff: false\nmeta data version: 49\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.212Z", "log.level":"TRACE", "message":"sending cluster state diff for version [51] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.213Z", "log.level":"DEBUG", "message":"received diff cluster state version [51] with uuid [gZ5-BTobSlGTRacPwti5Aw], diff size [750]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.218Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=51, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 51\nstate uuid: gZ5-BTobSlGTRacPwti5Aw\nfrom_diff: false\nmeta data version: 49\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 7):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.223Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [51] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.223Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.229Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:35.231Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.231Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.231Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.231Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:35.512Z", "log.level":"DEBUG", "message":"writing cluster state took [401ms]; wrote global metadata [true] and metadata for [0] indices and skipped [3] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.512Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=51}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.513Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.513Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=51}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.513Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [51] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.513Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [51] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.513Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=51, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.513Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [51]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.514Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=51}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.522Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=51}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.522Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.523Z", "log.level":"TRACE", "message":"lag detection for version 51 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.526Z", "log.level": "INFO", "message":"[.apm-agent-configuration] creating index, cause [api], templates [], shards [1]/[1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.528Z", "log.level": "INFO", "message":"updating number_of_replicas to [0] for indices [.apm-agent-configuration]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.530Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [52] in for node version [8.0.0] with size [706]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.530Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [52] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.531Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.534Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=52, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 52\nstate uuid: JI5l_QOWTVuRoLkOhU8SlA\nfrom_diff: false\nmeta data version: 50\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 8):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.573Z", "log.level":"TRACE", "message":"sending cluster state diff for version [52] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.575Z", "log.level":"DEBUG", "message":"received diff cluster state version [52] with uuid [JI5l_QOWTVuRoLkOhU8SlA], diff size [706]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.578Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=52, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 52\nstate uuid: JI5l_QOWTVuRoLkOhU8SlA\nfrom_diff: false\nmeta data version: 50\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 8):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.587Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [52] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.587Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.587Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.587Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.587Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.587Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]], changing version from [null] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.588Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:35.589Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:35.976Z", "log.level":"DEBUG", "message":"writing cluster state took [404ms]; wrote global metadata [false] and metadata for [1] indices and skipped [3] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.977Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=52}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.977Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.977Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=52}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.977Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [52] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.977Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [52] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.978Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=52, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.978Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [52]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:35.978Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=52}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.075Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=52}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.085Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.085Z", "log.level":"TRACE", "message":"lag detection for version 52 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.107Z", "log.level": "INFO", "message":"[.apm-custom-link] creating index, cause [api], templates [], shards [1]/[1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.122Z", "log.level": "INFO", "message":"updating number_of_replicas to [0] for indices [.apm-custom-link]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.143Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [53] in for node version [8.0.0] with size [626]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.161Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [53] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.161Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.165Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=53, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 53\nstate uuid: 3Br21eG-QWGyWcvyfOu7oA\nfrom_diff: false\nmeta data version: 51\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.200Z", "log.level":"TRACE", "message":"sending cluster state diff for version [53] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.201Z", "log.level":"DEBUG", "message":"received diff cluster state version [53] with uuid [3Br21eG-QWGyWcvyfOu7oA], diff size [626]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.204Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=53, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 53\nstate uuid: 3Br21eG-QWGyWcvyfOu7oA\nfrom_diff: false\nmeta data version: 51\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.221Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [53] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.221Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.221Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.221Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.240Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.240Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]], changing version from [null] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.240Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:36.277Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.277Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:36.791Z", "log.level":"DEBUG", "message":"writing cluster state took [609ms]; wrote global metadata [false] and metadata for [1] indices and skipped [4] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.791Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=53}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=53}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [53] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [53] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=53, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [53]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.792Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=53}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.924Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=53}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.939Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.939Z", "log.level":"TRACE", "message":"lag detection for version 53 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.942Z", "log.level": "INFO", "message":"adding template [.kibana_security_session_index_template_1] for index patterns [.kibana_security_session_1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.960Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [54] in for node version [8.0.0] with size [495]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.960Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [54] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.960Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:36.983Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=54, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 54\nstate uuid: CzQy1IhERTGmoo727Mx-rw\nfrom_diff: false\nmeta data version: 52\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.001Z", "log.level":"TRACE", "message":"sending cluster state diff for version [54] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.002Z", "log.level":"DEBUG", "message":"received diff cluster state version [54] with uuid [CzQy1IhERTGmoo727Mx-rw], diff size [495]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.022Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=54, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 54\nstate uuid: CzQy1IhERTGmoo727Mx-rw\nfrom_diff: false\nmeta data version: 52\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.228Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [54] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.228Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.234Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [42027]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.235Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:37.274Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.274Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.274Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.274Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.274Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.274Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:37.409Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.409Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=54}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.410Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.410Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=54}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.410Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [54] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.410Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [54] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.410Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=54, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.410Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [54]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.411Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=54}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.423Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=54}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.423Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.423Z", "log.level":"TRACE", "message":"lag detection for version 54 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.428Z", "log.level": "INFO", "message":"adding component template [.alerts-observability.apm.alerts-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.429Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [55] in for node version [8.0.0] with size [330]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.429Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [55] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.430Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.434Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=55, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 55\nstate uuid: wXW9SvjTT_i8tFdHBjDrTQ\nfrom_diff: false\nmeta data version: 53\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.481Z", "log.level":"TRACE", "message":"sending cluster state diff for version [55] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.482Z", "log.level":"DEBUG", "message":"received diff cluster state version [55] with uuid [wXW9SvjTT_i8tFdHBjDrTQ], diff size [330]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.487Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=55, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 55\nstate uuid: wXW9SvjTT_i8tFdHBjDrTQ\nfrom_diff: false\nmeta data version: 53\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.493Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [55] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.494Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.499Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:37.501Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.502Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.502Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.502Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.502Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.502Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:37.897Z", "log.level":"DEBUG", "message":"writing cluster state took [401ms]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.897Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=55}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=55}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [55] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [55] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=55, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [55]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.898Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=55}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.907Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=55}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.907Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.907Z", "log.level":"TRACE", "message":"lag detection for version 55 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.911Z", "log.level": "INFO", "message":"adding component template [.alerts-observability.metrics.alerts-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.912Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [56] in for node version [8.0.0] with size [219]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.912Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [56] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.912Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.915Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=56, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 56\nstate uuid: KSe8fGF7SgmnNkJKzbU0hw\nfrom_diff: false\nmeta data version: 54\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.920Z", "log.level":"TRACE", "message":"sending cluster state diff for version [56] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.921Z", "log.level":"DEBUG", "message":"received diff cluster state version [56] with uuid [KSe8fGF7SgmnNkJKzbU0hw], diff size [219]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.924Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=56, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 56\nstate uuid: KSe8fGF7SgmnNkJKzbU0hw\nfrom_diff: false\nmeta data version: 54\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.977Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [56] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.977Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.981Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:37.983Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.983Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.984Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.984Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.984Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:37.984Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:38.229Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.229Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=56}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.230Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.230Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=56}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.230Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [56] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.230Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [56] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.231Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=56, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.231Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [56]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.231Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=56}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.242Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=56}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.243Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.243Z", "log.level":"TRACE", "message":"lag detection for version 56 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.246Z", "log.level": "INFO", "message":"adding component template [.alerts-observability.uptime.alerts-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.247Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [57] in for node version [8.0.0] with size [478]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.247Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [57] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.247Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.251Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=57, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 57\nstate uuid: elFD4dNFR8ynE8B3COYfYw\nfrom_diff: false\nmeta data version: 55\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.257Z", "log.level":"TRACE", "message":"sending cluster state diff for version [57] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.258Z", "log.level":"DEBUG", "message":"received diff cluster state version [57] with uuid [elFD4dNFR8ynE8B3COYfYw], diff size [478]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.260Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=57, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 57\nstate uuid: elFD4dNFR8ynE8B3COYfYw\nfrom_diff: false\nmeta data version: 55\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.384Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [57] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.384Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.390Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:38.392Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.392Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.392Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.392Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.392Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.392Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:38.675Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.676Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=57}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.676Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.676Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=57}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.676Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [57] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.676Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [57] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.676Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=57, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.677Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [57]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.677Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=57}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.686Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=57}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.687Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.687Z", "log.level":"TRACE", "message":"lag detection for version 57 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.690Z", "log.level": "INFO", "message":"adding component template [.alerts-observability.logs.alerts-mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.690Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [58] in for node version [8.0.0] with size [217]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.691Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [58] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.691Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.693Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=58, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 58\nstate uuid: 4vuzJLGbQIegQpd03gWS1Q\nfrom_diff: false\nmeta data version: 56\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.699Z", "log.level":"TRACE", "message":"sending cluster state diff for version [58] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.700Z", "log.level":"DEBUG", "message":"received diff cluster state version [58] with uuid [4vuzJLGbQIegQpd03gWS1Q], diff size [217]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.703Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=58, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 58\nstate uuid: 4vuzJLGbQIegQpd03gWS1Q\nfrom_diff: false\nmeta data version: 56\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 9):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=aUHezjW2TMqx2JQxScrULA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:36.121Z], delayed=false, allocation_status[no_attempt]]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=c_j4tHVbQJW-onFL63E1pg], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:35.527Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.768Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [58] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.768Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.772Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:38.774Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.774Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.774Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.774Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.774Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:38.774Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:39.019Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.019Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=58}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.020Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.020Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=58}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.020Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [58] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.020Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [58] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.020Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=58, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.021Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [58]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.021Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=58}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.030Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=58}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.030Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.030Z", "log.level":"TRACE", "message":"lag detection for version 58 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.033Z", "log.level": "INFO",  "current.health":"GREEN", "message":"Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.apm-agent-configuration][0], [.apm-custom-link][0]]]).", "previous.health":"YELLOW", "reason":"shards started [[.apm-agent-configuration][0], [.apm-custom-link][0]]" , "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.034Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [59] in for node version [8.0.0] with size [495]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.034Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [59] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.034Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.038Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=59, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 59\nstate uuid: 7uhKB55nQZi3NZciRme_ng\nfrom_diff: false\nmeta data version: 57\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 10):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.043Z", "log.level":"TRACE", "message":"sending cluster state diff for version [59] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.045Z", "log.level":"DEBUG", "message":"received diff cluster state version [59] with uuid [7uhKB55nQZi3NZciRme_ng], diff size [495]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.048Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=59, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 59\nstate uuid: 7uhKB55nQZi3NZciRme_ng\nfrom_diff: false\nmeta data version: 57\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 10):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.112Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [59] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.112Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.112Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.112Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.112Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.113Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]], changing version from [4] to [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.113Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:39.114Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]], changing version from [4] to [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.115Z", "log.level":"TRACE", "message":"updating metadata for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:39.115Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:39.463Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [false] and metadata for [2] indices and skipped [3] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.464Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=59}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.464Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.464Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=59}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.464Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [59] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.464Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [59] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.464Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=59, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.465Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [59]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.465Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=59}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.474Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=59}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.486Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.487Z", "log.level":"TRACE", "message":"lag detection for version 59 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.491Z", "log.level": "INFO", "message":"[.kibana_security_session_1] creating index, cause [api], templates [.kibana_security_session_index_template_1], shards [1]/[0]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.507Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [60] in for node version [8.0.0] with size [693]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.526Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [60] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.527Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.530Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=60, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 60\nstate uuid: GqLSLpcjSc-hoicWtffXUQ\nfrom_diff: false\nmeta data version: 58\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 11):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.546Z", "log.level":"TRACE", "message":"sending cluster state diff for version [60] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.546Z", "log.level":"DEBUG", "message":"received diff cluster state version [60] with uuid [GqLSLpcjSc-hoicWtffXUQ], diff size [693]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.549Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=60, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 60\nstate uuid: GqLSLpcjSc-hoicWtffXUQ\nfrom_diff: false\nmeta data version: 58\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[9], mv[1], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 11):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.556Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [60] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.557Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.557Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.557Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.557Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]], changing version from [null] to [2]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.557Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:39.559Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.559Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.559Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.559Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:39.804Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [false] and metadata for [1] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.804Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=60}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.805Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.805Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=60}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.805Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [60] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.805Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [60] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.806Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=60, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.806Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [60]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.806Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=60}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.900Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=60}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.914Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.915Z", "log.level":"TRACE", "message":"lag detection for version 60 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.919Z", "log.level": "INFO", "message":"[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.955Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.960Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [61] in for node version [8.0.0] with size [8367]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.975Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [61] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.975Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:39.978Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=61, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 61\nstate uuid: 8t_PLLyKTqi6qOpyZutjkg\nfrom_diff: false\nmeta data version: 59\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 11):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.014Z", "log.level":"TRACE", "message":"sending cluster state diff for version [61] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.016Z", "log.level":"DEBUG", "message":"received diff cluster state version [61] with uuid [8t_PLLyKTqi6qOpyZutjkg], diff size [8367]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.036Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=61, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 61\nstate uuid: 8t_PLLyKTqi6qOpyZutjkg\nfrom_diff: false\nmeta data version: 59\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 11):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=YJWpkh1PQSeZ9aORp-Fh_g], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:39.505Z], delayed=false, allocation_status[no_attempt]]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.054Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [61] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.073Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.073Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [9] to [10]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.073Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:40.076Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]], changing version from [9] to [10]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.076Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:40.099Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.100Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.100Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.100Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.100Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:40.611Z", "log.level":"DEBUG", "message":"writing cluster state took [607ms]; wrote global metadata [false] and metadata for [2] indices and skipped [4] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.611Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=61}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.611Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.611Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=61}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.611Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [61] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.612Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [61] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.613Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=61, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.613Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [61]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.614Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=61}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.637Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=61}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.639Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.639Z", "log.level":"TRACE", "message":"lag detection for version 61 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.640Z", "log.level": "INFO",  "current.health":"GREEN", "message":"Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.kibana_security_session_1][0]]]).", "previous.health":"YELLOW", "reason":"shards started [[.kibana_security_session_1][0]]" , "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.659Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [62] in for node version [8.0.0] with size [446]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.659Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [62] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.660Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.663Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=62, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 62\nstate uuid: oiz9haYdSreA6vCOHaqLhA\nfrom_diff: false\nmeta data version: 60\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.737Z", "log.level":"TRACE", "message":"sending cluster state diff for version [62] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.756Z", "log.level":"DEBUG", "message":"received diff cluster state version [62] with uuid [oiz9haYdSreA6vCOHaqLhA], diff size [446]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.778Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=62, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 62\nstate uuid: oiz9haYdSreA6vCOHaqLhA\nfrom_diff: false\nmeta data version: 60\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.813Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [62] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.831Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.831Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.831Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.831Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]], changing version from [2] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.832Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:40.833Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.833Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.833Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:40.833Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:41.034Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [false] and metadata for [1] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.034Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=62}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.035Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.035Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=62}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.035Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [62] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.035Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [62] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.035Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=62, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.035Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [62]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.036Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=62}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.074Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=62}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.074Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.074Z", "log.level":"TRACE", "message":"lag detection for version 62 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.124Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.142Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.160Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [63] in for node version [8.0.0] with size [7802]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.161Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [63] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.161Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.165Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=63, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 63\nstate uuid: O_sDmdGUQHOv47JLYR6jJQ\nfrom_diff: false\nmeta data version: 61\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.173Z", "log.level":"TRACE", "message":"sending cluster state diff for version [63] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.174Z", "log.level":"DEBUG", "message":"received diff cluster state version [63] with uuid [O_sDmdGUQHOv47JLYR6jJQ], diff size [7802]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.179Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=63, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 63\nstate uuid: O_sDmdGUQHOv47JLYR6jJQ\nfrom_diff: false\nmeta data version: 61\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.242Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [63] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.242Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.242Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [10] to [12]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.243Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:41.244Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.244Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.245Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.245Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.245Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.245Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:41.724Z", "log.level":"DEBUG", "message":"writing cluster state took [407ms]; wrote global metadata [false] and metadata for [1] indices and skipped [5] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.724Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=63}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.724Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.724Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=63}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.725Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [63] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.725Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [63] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.725Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=63, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.725Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [63]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.726Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=63}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.748Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=63}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.767Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.786Z", "log.level":"TRACE", "message":"lag detection for version 63 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.831Z", "log.level": "INFO", "message":"adding index lifecycle policy [kibana-event-log-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.855Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [64] in for node version [8.0.0] with size [365]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.872Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [64] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.873Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.876Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=64, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 64\nstate uuid: TcUhZNEaRSOO5gTBfuwJsw\nfrom_diff: false\nmeta data version: 62\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.948Z", "log.level":"TRACE", "message":"sending cluster state diff for version [64] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.949Z", "log.level":"DEBUG", "message":"received diff cluster state version [64] with uuid [TcUhZNEaRSOO5gTBfuwJsw], diff size [365]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.971Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=64, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 64\nstate uuid: TcUhZNEaRSOO5gTBfuwJsw\nfrom_diff: false\nmeta data version: 62\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.987Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [64] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.988Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.991Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [42914]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.992Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:41.993Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:42.408Z", "log.level":"DEBUG", "message":"writing cluster state took [403ms]; wrote global metadata [true] and metadata for [0] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.408Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=64}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.408Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.408Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=64}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.409Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [64] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.409Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [64] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.409Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=64, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.409Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [64]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.409Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=64}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.418Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=64}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.418Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.419Z", "log.level":"TRACE", "message":"lag detection for version 64 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.420Z", "log.level": "INFO", "message":"adding index lifecycle policy [kibana-reporting]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.action.TransportPutLifecycleAction","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.421Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [65] in for node version [8.0.0] with size [327]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.421Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [65] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.421Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.424Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=65, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 65\nstate uuid: n9HjkQslRwecQhgICDI9Yw\nfrom_diff: false\nmeta data version: 63\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.429Z", "log.level":"TRACE", "message":"sending cluster state diff for version [65] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.430Z", "log.level":"DEBUG", "message":"received diff cluster state version [65] with uuid [n9HjkQslRwecQhgICDI9Yw], diff size [327]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.434Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=65, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 65\nstate uuid: n9HjkQslRwecQhgICDI9Yw\nfrom_diff: false\nmeta data version: 63\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.494Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [65] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.494Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.501Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:42.503Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.503Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.503Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.504Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.504Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.504Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.504Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:42.985Z", "log.level":"DEBUG", "message":"writing cluster state took [610ms]; wrote global metadata [true] and metadata for [0] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.985Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=65}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.986Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.986Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=65}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.986Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [65] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.986Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [65] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.987Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=65, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.987Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [65]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:42.987Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=65}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.008Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=65}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.008Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.008Z", "log.level":"TRACE", "message":"lag detection for version 65 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.013Z", "log.level": "INFO", "message":"adding template [.kibana-event-log-8.0.0-template] for index patterns [.kibana-event-log-8.0.0-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.014Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [66] in for node version [8.0.0] with size [963]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.014Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [66] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.014Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.017Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=66, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 66\nstate uuid: W3PLLHLkT1yOkbnu5-swzg\nfrom_diff: false\nmeta data version: 64\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.023Z", "log.level":"TRACE", "message":"sending cluster state diff for version [66] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.024Z", "log.level":"DEBUG", "message":"received diff cluster state version [66] with uuid [W3PLLHLkT1yOkbnu5-swzg], diff size [963]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.028Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=66, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 66\nstate uuid: W3PLLHLkT1yOkbnu5-swzg\nfrom_diff: false\nmeta data version: 64\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 12):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.110Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [66] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.110Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.117Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:43.150Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.169Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.170Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.170Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.188Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.188Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.189Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:43.740Z", "log.level":"DEBUG", "message":"writing cluster state took [606ms]; wrote global metadata [true] and metadata for [0] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.740Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=66}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.741Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.741Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=66}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.741Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [66] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.741Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [66] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.742Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=66, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.742Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [66]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.742Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=66}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.752Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=66}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.752Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.752Z", "log.level":"TRACE", "message":"lag detection for version 66 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.770Z", "log.level": "INFO", "message":"[.kibana-event-log-8.0.0-000001] creating index, cause [api], templates [.kibana-event-log-8.0.0-template], shards [1]/[1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.772Z", "log.level": "INFO", "message":"updating number_of_replicas to [0] for indices [.kibana-event-log-8.0.0-000001]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.775Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [67] in for node version [8.0.0] with size [1197]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.775Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [67] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.775Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.780Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=67, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 67\nstate uuid: OlRCPBeiT8uZoFebGu1uTg\nfrom_diff: false\nmeta data version: 65\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 13):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.808Z", "log.level":"TRACE", "message":"sending cluster state diff for version [67] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.827Z", "log.level":"DEBUG", "message":"received diff cluster state version [67] with uuid [OlRCPBeiT8uZoFebGu1uTg], diff size [1197]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.867Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=67, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 67\nstate uuid: OlRCPBeiT8uZoFebGu1uTg\nfrom_diff: false\nmeta data version: 65\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[4], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 13):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.882Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [67] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.882Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.882Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.882Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]], changing version from [null] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.882Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:43.885Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.885Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.885Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.885Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.885Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:43.885Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:44.071Z", "log.level": "INFO", "message":"Took [51ms] to resolve [9] indices for action [indices:data/read/search] and user [kibana_system]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#4]","log.logger":"org.elasticsearch.xpack.security.authz.AuthorizationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.093Z", "log.level": "INFO", "message":"Took [75ms] to resolve [9] indices for action [indices:data/read/search] and user [kibana_system]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#12]","log.logger":"org.elasticsearch.xpack.security.authz.AuthorizationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.112Z", "log.level": "INFO", "message":"Took [96ms] to resolve [9] indices for action [indices:data/read/get] and user [kibana_system]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#6]","log.logger":"org.elasticsearch.xpack.security.authz.AuthorizationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.113Z", "log.level": "INFO", "message":"Took [96ms] to resolve [9] indices for action [indices:data/read/get[s]] and user [kibana_system]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#7]","log.logger":"org.elasticsearch.xpack.security.authz.AuthorizationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.131Z", "log.level": "INFO", "message":"Took [112ms] to resolve [9] indices for action [indices:data/read/search[phase/query]] and user [kibana_system]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][transport_worker][T#9]","log.logger":"org.elasticsearch.xpack.security.authz.AuthorizationService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.378Z", "log.level":"DEBUG", "message":"writing cluster state took [605ms]; wrote global metadata [false] and metadata for [1] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.379Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=67}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.379Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.379Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=67}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.380Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [67] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.380Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [67] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.380Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=67, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.380Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [67]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.381Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=67}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.490Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=67}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.496Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.497Z", "log.level":"TRACE", "message":"lag detection for version 67 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.502Z", "log.level": "INFO", "message":"moving index [.kibana-event-log-8.0.0-000001] from [null] to [{\"phase\":\"new\",\"action\":\"complete\",\"name\":\"complete\"}] in policy [kibana-event-log-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.IndexLifecycleTransition","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.520Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [68] in for node version [8.0.0] with size [527]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.537Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [68] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.537Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.542Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=68, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 68\nstate uuid: NN0_WWwgScG5x5LCYPdjhw\nfrom_diff: false\nmeta data version: 66\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 13):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.559Z", "log.level":"TRACE", "message":"sending cluster state diff for version [68] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.561Z", "log.level":"DEBUG", "message":"received diff cluster state version [68] with uuid [NN0_WWwgScG5x5LCYPdjhw], diff size [527]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.590Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=68, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 68\nstate uuid: NN0_WWwgScG5x5LCYPdjhw\nfrom_diff: false\nmeta data version: 66\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 13):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=XldW9oLRT_-w11BhvLSCjA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:43.771Z], delayed=false, allocation_status[no_attempt]]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.604Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [68] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.604Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.605Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.605Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]], changing version from [4] to [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.605Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:44.626Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.627Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.627Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.627Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.646Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:44.646Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:45.344Z", "log.level":"DEBUG", "message":"writing cluster state took [606ms]; wrote global metadata [false] and metadata for [1] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.364Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=68}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.365Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.365Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=68}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.365Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [68] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.365Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [68] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.366Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=68, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.366Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [68]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.366Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=68}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.379Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=68}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.391Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.391Z", "log.level":"TRACE", "message":"lag detection for version 68 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.395Z", "log.level": "INFO",  "current.health":"GREEN", "message":"Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.kibana-event-log-8.0.0-000001][0]]]).", "previous.health":"YELLOW", "reason":"shards started [[.kibana-event-log-8.0.0-000001][0]]" , "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.413Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [69] in for node version [8.0.0] with size [453]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.413Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [69] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.413Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.416Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=69, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 69\nstate uuid: QooOWDRKSnabrWk7xFTENQ\nfrom_diff: false\nmeta data version: 67\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[8], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.421Z", "log.level":"TRACE", "message":"sending cluster state diff for version [69] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.422Z", "log.level":"DEBUG", "message":"received diff cluster state version [69] with uuid [QooOWDRKSnabrWk7xFTENQ], diff size [453]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.427Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=69, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 69\nstate uuid: QooOWDRKSnabrWk7xFTENQ\nfrom_diff: false\nmeta data version: 67\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[8], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[12], mv[4], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.542Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [69] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.542Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.543Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.543Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]], changing version from [6] to [8]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.544Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:45.546Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.546Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.546Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.546Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.547Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.547Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:45.976Z", "log.level":"DEBUG", "message":"writing cluster state took [400ms]; wrote global metadata [false] and metadata for [1] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.976Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=69}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.976Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.976Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=69}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.976Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [69] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.976Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [69] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.977Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=69, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.977Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [69]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.977Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=69}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.985Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=69}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.999Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:45.999Z", "log.level":"TRACE", "message":"lag detection for version 69 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.012Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.019Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [70] in for node version [8.0.0] with size [7809]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.037Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [70] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.038Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.078Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=70, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 70\nstate uuid: uUtiOfySTPacmCmhO-ABgA\nfrom_diff: false\nmeta data version: 68\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[8], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.168Z", "log.level":"TRACE", "message":"sending cluster state diff for version [70] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.186Z", "log.level":"DEBUG", "message":"received diff cluster state version [70] with uuid [uUtiOfySTPacmCmhO-ABgA], diff size [7809]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.189Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=70, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 70\nstate uuid: uUtiOfySTPacmCmhO-ABgA\nfrom_diff: false\nmeta data version: 68\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[8], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.195Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [70] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.195Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.195Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.195Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.195Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [12] to [13]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.195Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:46.197Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.197Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.197Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.197Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.197Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:46.959Z", "log.level":"DEBUG", "message":"writing cluster state took [611ms]; wrote global metadata [false] and metadata for [1] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.960Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=70}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.960Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.960Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=70}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.960Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [70] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.961Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [70] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.961Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=70, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.961Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [70]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.962Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=70}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.979Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=70}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.984Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.985Z", "log.level":"TRACE", "message":"lag detection for version 70 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"2ac8a14b535ebee167cdc45a547c413b","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:46.998Z", "log.level": "INFO", "message":"moving index [.kibana-event-log-8.0.0-000001] from [{\"phase\":\"new\",\"action\":\"complete\",\"name\":\"complete\"}] to [{\"phase\":\"hot\",\"action\":\"unfollow\",\"name\":\"branch-check-unfollow-prerequisites\"}] in policy [kibana-event-log-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.IndexLifecycleTransition","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.005Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [71] in for node version [8.0.0] with size [588]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.005Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [71] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.005Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.010Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=71, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 71\nstate uuid: vWZq9_sfRKadjLMmqJ7ELQ\nfrom_diff: false\nmeta data version: 69\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[9], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.028Z", "log.level":"TRACE", "message":"sending cluster state diff for version [71] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.029Z", "log.level":"DEBUG", "message":"received diff cluster state version [71] with uuid [vWZq9_sfRKadjLMmqJ7ELQ], diff size [588]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.058Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=71, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 71\nstate uuid: vWZq9_sfRKadjLMmqJ7ELQ\nfrom_diff: false\nmeta data version: 69\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[9], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.064Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [71] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.064Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.064Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.064Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]], changing version from [8] to [9]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.064Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:47.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.066Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.066Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.066Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:47.833Z", "log.level":"DEBUG", "message":"writing cluster state took [807ms]; wrote global metadata [false] and metadata for [1] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.834Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=71}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.834Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.835Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=71}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.835Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [71] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.835Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [71] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.836Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=71, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.836Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [71]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.837Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=71}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.851Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=71}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.863Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.864Z", "log.level":"TRACE", "message":"lag detection for version 71 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.868Z", "log.level": "INFO", "message":"moving index [.kibana-event-log-8.0.0-000001] from [{\"phase\":\"hot\",\"action\":\"unfollow\",\"name\":\"branch-check-unfollow-prerequisites\"}] to [{\"phase\":\"hot\",\"action\":\"rollover\",\"name\":\"check-rollover-ready\"}] in policy [kibana-event-log-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.IndexLifecycleTransition","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.886Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [72] in for node version [8.0.0] with size [458]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.904Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [72] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.905Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.908Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=72, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 72\nstate uuid: OFKtpCMCTIun3WyYmUl7Kg\nfrom_diff: false\nmeta data version: 70\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.924Z", "log.level":"TRACE", "message":"sending cluster state diff for version [72] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.925Z", "log.level":"DEBUG", "message":"received diff cluster state version [72] with uuid [OFKtpCMCTIun3WyYmUl7Kg], diff size [458]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.929Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=72, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 72\nstate uuid: OFKtpCMCTIun3WyYmUl7Kg\nfrom_diff: false\nmeta data version: 70\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   index-graveyard: IndexGraveyard[[]]\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 14):\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.934Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [72] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.934Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.934Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.973Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]], changing version from [9] to [10]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.973Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:47.974Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.975Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.975Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.975Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.975Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:47.975Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:48.630Z", "log.level":"DEBUG", "message":"writing cluster state took [807ms]; wrote global metadata [false] and metadata for [1] indices and skipped [6] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.630Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=72}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.631Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.631Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=72}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.631Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [72] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.631Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [72] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.632Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=72, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.632Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [72]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.632Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=72}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.641Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=72}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.656Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:48.656Z", "log.level":"TRACE", "message":"lag detection for version 72 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.353Z", "log.level": "INFO", "message":"[.ds-ilm-history-5-2021.09.09-000001] creating index, cause [initialize_data_stream], templates [ilm-history], shards [1]/[0]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateIndexService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.356Z", "log.level": "INFO", "message":"adding data stream [ilm-history-5] with write index [.ds-ilm-history-5-2021.09.09-000001], backing indices [], and aliases []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataCreateDataStreamService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.359Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [73] in for node version [8.0.0] with size [891]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.359Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [73] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.359Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.362Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=73, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 73\nstate uuid: BC3FTLNiQ2ybmxcwAmGflA\nfrom_diff: false\nmeta data version: 71\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 15):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.367Z", "log.level":"TRACE", "message":"sending cluster state diff for version [73] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.369Z", "log.level":"DEBUG", "message":"received diff cluster state version [73] with uuid [BC3FTLNiQ2ybmxcwAmGflA], diff size [891]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.372Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=73, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 73\nstate uuid: BC3FTLNiQ2ybmxcwAmGflA\nfrom_diff: false\nmeta data version: 71\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[2], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 15):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.442Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [73] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.442Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.449Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [44727]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.449Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:49.457Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.458Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]], changing version from [null] to [2]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.458Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:49.458Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.459Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.459Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.459Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.459Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.459Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.459Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:49.552Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.552Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=73}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.552Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.552Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=73}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.553Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [73] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.553Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [73] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.553Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=73, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.553Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [73]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.553Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=73}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.646Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=73}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.660Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.660Z", "log.level":"TRACE", "message":"lag detection for version 73 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.662Z", "log.level": "INFO", "message":"moving index [.ds-ilm-history-5-2021.09.09-000001] from [null] to [{\"phase\":\"new\",\"action\":\"complete\",\"name\":\"complete\"}] in policy [ilm-history-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.IndexLifecycleTransition","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.681Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [74] in for node version [8.0.0] with size [521]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.700Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [74] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.701Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.704Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=74, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 74\nstate uuid: hM8zyxMRS22Vf49uMZ6isg\nfrom_diff: false\nmeta data version: 72\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 15):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.722Z", "log.level":"TRACE", "message":"sending cluster state diff for version [74] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.722Z", "log.level":"DEBUG", "message":"received diff cluster state version [74] with uuid [hM8zyxMRS22Vf49uMZ6isg], diff size [521]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.743Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=74, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 74\nstate uuid: hM8zyxMRS22Vf49uMZ6isg\nfrom_diff: false\nmeta data version: 72\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids []\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 15):\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], recovery_source[new shard recovery], s[INITIALIZING], a[id=_VYEYp8UR4atApeH1WfnaA], unassigned_info[[reason=INDEX_CREATED], at[2021-09-09T15:22:49.354Z], delayed=false, allocation_status[no_attempt]]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.760Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [74] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.760Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.760Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.761Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]], changing version from [2] to [4]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.761Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:49.780Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.780Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.780Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.780Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.781Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.781Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:49.781Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.101Z", "log.level":"DEBUG", "message":"writing cluster state took [402ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.102Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=74}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.102Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.102Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=74}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.102Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [74] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.102Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [74] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.102Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=74, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.103Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [74]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.103Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=74}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.111Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=74}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.123Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.123Z", "log.level":"TRACE", "message":"lag detection for version 74 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.125Z", "log.level": "INFO",  "current.health":"GREEN", "message":"Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.ds-ilm-history-5-2021.09.09-000001][0]]]).", "previous.health":"YELLOW", "reason":"shards started [[.ds-ilm-history-5-2021.09.09-000001][0]]" , "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.routing.allocation.AllocationService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.144Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [75] in for node version [8.0.0] with size [448]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.144Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [75] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.144Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.147Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=75, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 75\nstate uuid: OrYqxI8dSgisSkNMJ2tU9w\nfrom_diff: false\nmeta data version: 73\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[6], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.152Z", "log.level":"TRACE", "message":"sending cluster state diff for version [75] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.153Z", "log.level":"DEBUG", "message":"received diff cluster state version [75] with uuid [OrYqxI8dSgisSkNMJ2tU9w], diff size [448]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.156Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=75, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 75\nstate uuid: OrYqxI8dSgisSkNMJ2tU9w\nfrom_diff: false\nmeta data version: 73\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[6], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.199Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [75] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.199Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.199Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.199Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]], changing version from [4] to [6]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.199Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.201Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.273Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.274Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=75}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.274Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.274Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=75}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.275Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [75] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.275Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [75] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.275Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=75, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.275Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [75]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.275Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=75}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.284Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=75}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.296Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.296Z", "log.level":"TRACE", "message":"lag detection for version 75 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.297Z", "log.level": "INFO", "message":"moving index [.ds-ilm-history-5-2021.09.09-000001] from [{\"phase\":\"new\",\"action\":\"complete\",\"name\":\"complete\"}] to [{\"phase\":\"hot\",\"action\":\"unfollow\",\"name\":\"branch-check-unfollow-prerequisites\"}] in policy [ilm-history-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.IndexLifecycleTransition","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.316Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [76] in for node version [8.0.0] with size [598]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.317Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [76] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.317Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.319Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=76, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 76\nstate uuid: xZQmKCH7Rzi64PNox9oAjA\nfrom_diff: false\nmeta data version: 74\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[7], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.356Z", "log.level":"TRACE", "message":"sending cluster state diff for version [76] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.357Z", "log.level":"DEBUG", "message":"received diff cluster state version [76] with uuid [xZQmKCH7Rzi64PNox9oAjA], diff size [598]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.377Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=76, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 76\nstate uuid: xZQmKCH7Rzi64PNox9oAjA\nfrom_diff: false\nmeta data version: 74\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[7], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.395Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [76] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.395Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.395Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.395Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]], changing version from [6] to [7]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.395Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.397Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.467Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.467Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=76}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=76}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [76] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [76] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=76, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [76]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.468Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=76}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.475Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=76}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.488Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.488Z", "log.level":"TRACE", "message":"lag detection for version 76 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.490Z", "log.level": "INFO", "message":"moving index [.ds-ilm-history-5-2021.09.09-000001] from [{\"phase\":\"hot\",\"action\":\"unfollow\",\"name\":\"branch-check-unfollow-prerequisites\"}] to [{\"phase\":\"hot\",\"action\":\"rollover\",\"name\":\"check-rollover-ready\"}] in policy [ilm-history-ilm-policy]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.xpack.ilm.IndexLifecycleTransition","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.509Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [77] in for node version [8.0.0] with size [457]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.509Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [77] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.509Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.512Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=77, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 77\nstate uuid: 3qpTi73IScm42ipboRwugw\nfrom_diff: false\nmeta data version: 75\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.516Z", "log.level":"TRACE", "message":"sending cluster state diff for version [77] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.517Z", "log.level":"DEBUG", "message":"received diff cluster state version [77] with uuid [3qpTi73IScm42ipboRwugw], diff size [457]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.519Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=77, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 77\nstate uuid: 3qpTi73IScm42ipboRwugw\nfrom_diff: false\nmeta data version: 75\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[13], mv[5], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.568Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [77] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.568Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.568Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.568Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]], changing version from [7] to [8]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.568Z", "log.level":"TRACE", "message":"updating metadata for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.570Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.570Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.570Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.570Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.570Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.571Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.571Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:50.648Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.648Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=77}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.648Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.648Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=77}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.648Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [77] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.648Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [77] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.649Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=77, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.649Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [77]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.649Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=77}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.657Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=77}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.669Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:50.669Z", "log.level":"TRACE", "message":"lag detection for version 77 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.905Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.906Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [78] in for node version [8.0.0] with size [7810]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.906Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [78] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.906Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.909Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=78, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 78\nstate uuid: wjYXg8AORyul3Og3ojm9Xg\nfrom_diff: false\nmeta data version: 76\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[14], mv[6], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.914Z", "log.level":"TRACE", "message":"sending cluster state diff for version [78] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.915Z", "log.level":"DEBUG", "message":"received diff cluster state version [78] with uuid [wjYXg8AORyul3Og3ojm9Xg], diff size [7810]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.917Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=78, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 78\nstate uuid: wjYXg8AORyul3Og3ojm9Xg\nfrom_diff: false\nmeta data version: 76\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[14], mv[6], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.954Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [78] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.954Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.954Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.954Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.954Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.954Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [13] to [14]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.955Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:55.956Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.956Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.957Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.957Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:55.957Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:56.035Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.035Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=78}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.035Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.035Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=78}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.035Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [78] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.036Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [78] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.036Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=78, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.036Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [78]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.036Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=78}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.052Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=78}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.057Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.058Z", "log.level":"TRACE", "message":"lag detection for version 78 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.919Z", "log.level": "INFO", "message":"adding component template [.fleet_component_template-1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.926Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [79] in for node version [8.0.0] with size [365]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.949Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [79] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.949Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.954Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=79, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 79\nstate uuid: imvHxRpzReKEVkQKZQDl-g\nfrom_diff: false\nmeta data version: 77\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[14], mv[6], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.961Z", "log.level":"TRACE", "message":"sending cluster state diff for version [79] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.962Z", "log.level":"DEBUG", "message":"received diff cluster state version [79] with uuid [imvHxRpzReKEVkQKZQDl-g], diff size [365]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:56.966Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=79, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 79\nstate uuid: imvHxRpzReKEVkQKZQDl-g\nfrom_diff: false\nmeta data version: 77\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[14], mv[6], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@93f512bc   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.025Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [79] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.025Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.033Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [44927]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.033Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:57.034Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.035Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:57.114Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.115Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=79}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.115Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.115Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=79}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.115Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [79] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.115Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [79] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.116Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=79, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.116Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [79]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.116Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=79}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.131Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=79}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.131Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.131Z", "log.level":"TRACE", "message":"lag detection for version 79 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.133Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [80] in for node version [8.0.0] with size [1385]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.133Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [80] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.133Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.141Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=80, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 80\nstate uuid: Da1g1cO3TVeMvY3kL-oYZg\nfrom_diff: false\nmeta data version: 78\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[14], mv[6], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.148Z", "log.level":"TRACE", "message":"sending cluster state diff for version [80] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.149Z", "log.level":"DEBUG", "message":"received diff cluster state version [80] with uuid [Da1g1cO3TVeMvY3kL-oYZg], diff size [1385]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.157Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=80, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 80\nstate uuid: Da1g1cO3TVeMvY3kL-oYZg\nfrom_diff: false\nmeta data version: 78\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[14], mv[6], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.224Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [80] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.225Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.231Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:57.233Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.233Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.233Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.233Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.234Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.234Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.234Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.234Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.234Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:22:57.310Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.310Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=80}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.311Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.311Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=80}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.311Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [80] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.311Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [80] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.311Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=80, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.311Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [80]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.312Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=80}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.325Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=80}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.325Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:22:57.325Z", "log.level":"TRACE", "message":"lag detection for version 80 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.064Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.065Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [81] in for node version [8.0.0] with size [7815]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.065Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [81] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.066Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.069Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=81, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 81\nstate uuid: c4B7HL5yRt-gUVl_hyAMKA\nfrom_diff: false\nmeta data version: 79\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[15], mv[7], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.074Z", "log.level":"TRACE", "message":"sending cluster state diff for version [81] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.074Z", "log.level":"DEBUG", "message":"received diff cluster state version [81] with uuid [c4B7HL5yRt-gUVl_hyAMKA], diff size [7815]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.078Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=81, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 81\nstate uuid: c4B7HL5yRt-gUVl_hyAMKA\nfrom_diff: false\nmeta data version: 79\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[15], mv[7], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [81] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [14] to [15]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.231Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:00.233Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.233Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.233Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.233Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.233Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:00.309Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.309Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=81}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.309Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.309Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=81}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.309Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [81] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.310Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [81] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.310Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=81, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.310Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [81]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.310Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=81}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.331Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=81}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.332Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:00.332Z", "log.level":"TRACE", "message":"lag detection for version 81 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.033Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.047Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [82] in for node version [8.0.0] with size [7829]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.047Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [82] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.047Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.050Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=82, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 82\nstate uuid: nLosyI2yRXqumkU37JkiSA\nfrom_diff: false\nmeta data version: 80\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[16], mv[8], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.057Z", "log.level":"TRACE", "message":"sending cluster state diff for version [82] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.058Z", "log.level":"DEBUG", "message":"received diff cluster state version [82] with uuid [nLosyI2yRXqumkU37JkiSA], diff size [7829]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.064Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=82, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 82\nstate uuid: nLosyI2yRXqumkU37JkiSA\nfrom_diff: false\nmeta data version: 80\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[16], mv[8], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.107Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [82] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.107Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.108Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.108Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.108Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.108Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [15] to [16]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.108Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:03.111Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.111Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.111Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.111Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.111Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:03.186Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.186Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=82}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.186Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.186Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=82}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.187Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [82] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.187Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [82] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.187Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=82, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.187Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [82]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.188Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=82}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.206Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=82}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.206Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.207Z", "log.level":"TRACE", "message":"lag detection for version 82 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.218Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.231Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.249Z", "log.level": "INFO", "message":"[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA] update_mapping [_doc]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataMappingService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.276Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [83] in for node version [8.0.0] with size [7849]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.281Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [83] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.299Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.303Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=83, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 83\nstate uuid: CNauMdnHTmu4vwxD5W55Fg\nfrom_diff: false\nmeta data version: 81\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.337Z", "log.level":"TRACE", "message":"sending cluster state diff for version [83] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.338Z", "log.level":"DEBUG", "message":"received diff cluster state version [83] with uuid [CNauMdnHTmu4vwxD5W55Fg], diff size [7849]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.341Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=83, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 83\nstate uuid: CNauMdnHTmu4vwxD5W55Fg\nfrom_diff: false\nmeta data version: 81\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@2f0e461   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.346Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [83] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.346Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.346Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.347Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.347Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.347Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]], changing version from [16] to [19]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.347Z", "log.level":"TRACE", "message":"updating metadata for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:03.348Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.348Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.348Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.348Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.348Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:03.495Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [false] and metadata for [1] indices and skipped [7] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.495Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=83}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.496Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.496Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=83}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.496Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [83] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.496Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [83] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.496Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=83, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.497Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [83]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.497Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=83}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.520Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=83}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.538Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:03.538Z", "log.level":"TRACE", "message":"lag detection for version 83 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.229Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [84] in for node version [8.0.0] with size [431]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.235Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [84] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.235Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.257Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=84, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 84\nstate uuid: 5nUQVeVITr2XaEdNimSRWQ\nfrom_diff: false\nmeta data version: 82\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@1acbc845   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.264Z", "log.level":"TRACE", "message":"sending cluster state diff for version [84] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.265Z", "log.level":"DEBUG", "message":"received diff cluster state version [84] with uuid [5nUQVeVITr2XaEdNimSRWQ], diff size [431]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.269Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=84, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 84\nstate uuid: 5nUQVeVITr2XaEdNimSRWQ\nfrom_diff: false\nmeta data version: 82\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@1acbc845   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.320Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [84] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.320Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.325Z", "log.level":"TRACE", "message":"growing document buffer from [16384] to [47677]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.325Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:05.326Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.327Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:05.402Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.402Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=84}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.402Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.402Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=84}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.402Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [84] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.402Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [84] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.403Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=84, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.403Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [84]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.403Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=84}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.412Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=84}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.412Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.412Z", "log.level":"TRACE", "message":"lag detection for version 84 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.415Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.apm_server@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.416Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [85] in for node version [8.0.0] with size [260]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.416Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [85] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.416Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.419Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=85, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 85\nstate uuid: wPk8ghavSTaqOvP3VwvIzQ\nfrom_diff: false\nmeta data version: 83\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@1acbc845   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.425Z", "log.level":"TRACE", "message":"sending cluster state diff for version [85] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.426Z", "log.level":"DEBUG", "message":"received diff cluster state version [85] with uuid [wPk8ghavSTaqOvP3VwvIzQ], diff size [260]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.431Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=85, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 85\nstate uuid: wPk8ghavSTaqOvP3VwvIzQ\nfrom_diff: false\nmeta data version: 83\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@1acbc845   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.607Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [85] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.607Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.615Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:05.618Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.619Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.624Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.626Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.633Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.634Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.635Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.635Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.636Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:05.718Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.718Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=85}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.718Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.718Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=85}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.718Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [85] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.718Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [85] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.719Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=85, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.719Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [85]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.719Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=85}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.732Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=85}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.732Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.732Z", "log.level":"TRACE", "message":"lag detection for version 85 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.735Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.apm_server@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.735Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [86] in for node version [8.0.0] with size [220]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.736Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [86] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.736Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.740Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=86, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 86\nstate uuid: FEwUiGtGSBKN7jPXOMLaRQ\nfrom_diff: false\nmeta data version: 84\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@1acbc845   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.745Z", "log.level":"TRACE", "message":"sending cluster state diff for version [86] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.746Z", "log.level":"DEBUG", "message":"received diff cluster state version [86] with uuid [FEwUiGtGSBKN7jPXOMLaRQ], diff size [220]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.750Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=86, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 86\nstate uuid: FEwUiGtGSBKN7jPXOMLaRQ\nfrom_diff: false\nmeta data version: 84\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@1acbc845   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.930Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [86] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.930Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.935Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:05.936Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.134Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.134Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=86}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.135Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.135Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=86}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.135Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [86] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.135Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [86] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.135Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=86, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.135Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [86]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.136Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=86}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.144Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=86}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.145Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.145Z", "log.level":"TRACE", "message":"lag detection for version 86 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.146Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [87] in for node version [8.0.0] with size [1872]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.146Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [87] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.146Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.149Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=87, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 87\nstate uuid: upliVd9RRpGa0yQ0FFLn1Q\nfrom_diff: false\nmeta data version: 85\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.154Z", "log.level":"TRACE", "message":"sending cluster state diff for version [87] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.155Z", "log.level":"DEBUG", "message":"received diff cluster state version [87] with uuid [upliVd9RRpGa0yQ0FFLn1Q], diff size [1872]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.159Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=87, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 87\nstate uuid: upliVd9RRpGa0yQ0FFLn1Q\nfrom_diff: false\nmeta data version: 85\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.208Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [87] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.208Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.215Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.216Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.216Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.216Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.217Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.217Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.217Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.217Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.217Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.217Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.288Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.288Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=87}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.288Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.288Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=87}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.288Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [87] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.288Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [87] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.289Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=87, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.289Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [87]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.289Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=87}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.348Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=87}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.348Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.348Z", "log.level":"TRACE", "message":"lag detection for version 87 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.356Z", "log.level": "INFO", "message":"adding index template [logs-elastic_agent.apm_server] for index patterns [logs-elastic_agent.apm_server-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.357Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [88] in for node version [8.0.0] with size [1308]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.357Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [88] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.358Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.368Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=88, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 88\nstate uuid: uweD9zaWTniDcYYXX0ZdNg\nfrom_diff: false\nmeta data version: 86\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.376Z", "log.level":"TRACE", "message":"sending cluster state diff for version [88] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.377Z", "log.level":"DEBUG", "message":"received diff cluster state version [88] with uuid [uweD9zaWTniDcYYXX0ZdNg], diff size [1308]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.386Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=88, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 88\nstate uuid: uweD9zaWTniDcYYXX0ZdNg\nfrom_diff: false\nmeta data version: 86\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.480Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [88] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.480Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.490Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.492Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.492Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.493Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.574Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.575Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=88}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.575Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.575Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=88}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.575Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [88] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.575Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [88] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.576Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=88, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.576Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [88]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.576Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=88}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.592Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=88}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.593Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.593Z", "log.level":"TRACE", "message":"lag detection for version 88 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.625Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.apm_server@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.626Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [89] in for node version [8.0.0] with size [262]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.626Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [89] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.626Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.634Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=89, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 89\nstate uuid: hnVOQMWTRHWMEVB8NF3FyQ\nfrom_diff: false\nmeta data version: 87\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.650Z", "log.level":"TRACE", "message":"sending cluster state diff for version [89] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.651Z", "log.level":"DEBUG", "message":"received diff cluster state version [89] with uuid [hnVOQMWTRHWMEVB8NF3FyQ], diff size [262]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.658Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=89, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 89\nstate uuid: hnVOQMWTRHWMEVB8NF3FyQ\nfrom_diff: false\nmeta data version: 87\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.739Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [89] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.740Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.747Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.749Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.749Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.749Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.749Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.750Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.750Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.750Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.750Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.750Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:06.943Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.944Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=89}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.944Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.944Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=89}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.944Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [89] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.944Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [89] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.944Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=89, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.945Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [89]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.945Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=89}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.957Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=89}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.957Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.957Z", "log.level":"TRACE", "message":"lag detection for version 89 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.960Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.apm_server@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.961Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [90] in for node version [8.0.0] with size [222]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.961Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [90] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.961Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.967Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=90, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 90\nstate uuid: fAnI-MkzRNO3lrtVURZQyQ\nfrom_diff: false\nmeta data version: 88\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.973Z", "log.level":"TRACE", "message":"sending cluster state diff for version [90] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.974Z", "log.level":"DEBUG", "message":"received diff cluster state version [90] with uuid [fAnI-MkzRNO3lrtVURZQyQ], diff size [222]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:06.979Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=90, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 90\nstate uuid: fAnI-MkzRNO3lrtVURZQyQ\nfrom_diff: false\nmeta data version: 88\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@7c218f2a   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.055Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [90] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.056Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.064Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.065Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.066Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.144Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.144Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=90}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.144Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.144Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=90}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.145Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [90] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.145Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [90] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.145Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=90, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.145Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [90]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.145Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=90}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.153Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=90}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.154Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.154Z", "log.level":"TRACE", "message":"lag detection for version 90 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.156Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [91] in for node version [8.0.0] with size [23370]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.156Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [91] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.156Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.170Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=91, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 91\nstate uuid: PTMXdR7uT5a0_RGUlrIC_A\nfrom_diff: false\nmeta data version: 89\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@d8440440   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.176Z", "log.level":"TRACE", "message":"sending cluster state diff for version [91] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.178Z", "log.level":"DEBUG", "message":"received diff cluster state version [91] with uuid [PTMXdR7uT5a0_RGUlrIC_A], diff size [23370]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.192Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=91, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 91\nstate uuid: PTMXdR7uT5a0_RGUlrIC_A\nfrom_diff: false\nmeta data version: 89\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@d8440440   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.239Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [91] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.239Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.250Z", "log.level":"TRACE", "message":"growing document buffer from [71415] to [138024]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.250Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.252Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.326Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.326Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=91}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.326Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.327Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=91}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.327Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [91] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.327Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [91] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.327Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=91, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.327Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [91]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.327Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=91}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.353Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=91}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.353Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.353Z", "log.level":"TRACE", "message":"lag detection for version 91 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.360Z", "log.level": "INFO", "message":"adding index template [metrics-elastic_agent.apm_server] for index patterns [metrics-elastic_agent.apm_server-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.360Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [92] in for node version [8.0.0] with size [2070]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.360Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [92] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.361Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.370Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=92, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 92\nstate uuid: rC3tDewCTpupTRfqo0z86g\nfrom_diff: false\nmeta data version: 90\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@d8440440   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.376Z", "log.level":"TRACE", "message":"sending cluster state diff for version [92] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.377Z", "log.level":"DEBUG", "message":"received diff cluster state version [92] with uuid [rC3tDewCTpupTRfqo0z86g], diff size [2070]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.385Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=92, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 92\nstate uuid: rC3tDewCTpupTRfqo0z86g\nfrom_diff: false\nmeta data version: 90\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@d8440440   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.429Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [92] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.429Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.441Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.442Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.514Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.514Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=92}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.514Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.514Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=92}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.514Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [92] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.515Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [92] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.515Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=92, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.515Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [92]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.515Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=92}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.527Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=92}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.527Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.528Z", "log.level":"TRACE", "message":"lag detection for version 92 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.529Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [93] in for node version [8.0.0] with size [653]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.529Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [93] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.529Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.537Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=93, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 93\nstate uuid: tZ4diGJUR4ashKk3sYBqpA\nfrom_diff: false\nmeta data version: 91\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@b5f82f72   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.542Z", "log.level":"TRACE", "message":"sending cluster state diff for version [93] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.542Z", "log.level":"DEBUG", "message":"received diff cluster state version [93] with uuid [tZ4diGJUR4ashKk3sYBqpA], diff size [653]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.551Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=93, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 93\nstate uuid: tZ4diGJUR4ashKk3sYBqpA\nfrom_diff: false\nmeta data version: 91\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@b5f82f72   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.690Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [93] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.690Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.701Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.703Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.776Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.776Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=93}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.777Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.777Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=93}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.777Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [93] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.777Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [93] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.777Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=93, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.778Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [93]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.778Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=93}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.803Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=93}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.803Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.803Z", "log.level":"TRACE", "message":"lag detection for version 93 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.806Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.auditbeat@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.806Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [94] in for node version [8.0.0] with size [259]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.806Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [94] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.807Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.816Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=94, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 94\nstate uuid: -Eg_b2JmTcaDN1WIyim6ww\nfrom_diff: false\nmeta data version: 92\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@b5f82f72   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.821Z", "log.level":"TRACE", "message":"sending cluster state diff for version [94] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.822Z", "log.level":"DEBUG", "message":"received diff cluster state version [94] with uuid [-Eg_b2JmTcaDN1WIyim6ww], diff size [259]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.830Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=94, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 94\nstate uuid: -Eg_b2JmTcaDN1WIyim6ww\nfrom_diff: false\nmeta data version: 92\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@b5f82f72   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.871Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [94] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.871Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.881Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.882Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.883Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:07.993Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.993Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=94}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=94}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [94] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [94] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=94, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [94]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:07.994Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=94}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.008Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=94}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.008Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.008Z", "log.level":"TRACE", "message":"lag detection for version 94 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.010Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.auditbeat@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.011Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [95] in for node version [8.0.0] with size [219]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.011Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [95] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.011Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.020Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=95, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 95\nstate uuid: f53w1wNXRZS4WBnon6J6lg\nfrom_diff: false\nmeta data version: 93\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@b5f82f72   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.025Z", "log.level":"TRACE", "message":"sending cluster state diff for version [95] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.025Z", "log.level":"DEBUG", "message":"received diff cluster state version [95] with uuid [f53w1wNXRZS4WBnon6J6lg], diff size [219]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.033Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=95, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 95\nstate uuid: f53w1wNXRZS4WBnon6J6lg\nfrom_diff: false\nmeta data version: 93\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@b5f82f72   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.072Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [95] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.072Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.085Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.086Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.087Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.201Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.201Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=95}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.202Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.202Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=95}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.202Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [95] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.202Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [95] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.202Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=95, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.202Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [95]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.203Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=95}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.216Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=95}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.216Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.216Z", "log.level":"TRACE", "message":"lag detection for version 95 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.217Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [96] in for node version [8.0.0] with size [426]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.217Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [96] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.217Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.227Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=96, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 96\nstate uuid: CZhJJCX7R9ax0fcmufnN_w\nfrom_diff: false\nmeta data version: 94\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.232Z", "log.level":"TRACE", "message":"sending cluster state diff for version [96] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.233Z", "log.level":"DEBUG", "message":"received diff cluster state version [96] with uuid [CZhJJCX7R9ax0fcmufnN_w], diff size [426]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.241Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=96, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 96\nstate uuid: CZhJJCX7R9ax0fcmufnN_w\nfrom_diff: false\nmeta data version: 94\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.282Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [96] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.282Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.292Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.293Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.293Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.293Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.293Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.294Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.294Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.294Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.294Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.294Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.368Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.368Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=96}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.368Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.368Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=96}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.368Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [96] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.368Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [96] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.369Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=96, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.369Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [96]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.369Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=96}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.388Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=96}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.388Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.388Z", "log.level":"TRACE", "message":"lag detection for version 96 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.394Z", "log.level": "INFO", "message":"adding index template [logs-elastic_agent.auditbeat] for index patterns [logs-elastic_agent.auditbeat-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.394Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [97] in for node version [8.0.0] with size [1308]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.395Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [97] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.395Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.405Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=97, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 97\nstate uuid: Hv3uYt6eThqJLDSNT-ztYw\nfrom_diff: false\nmeta data version: 95\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.438Z", "log.level":"TRACE", "message":"sending cluster state diff for version [97] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.439Z", "log.level":"DEBUG", "message":"received diff cluster state version [97] with uuid [Hv3uYt6eThqJLDSNT-ztYw], diff size [1308]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.447Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=97, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 97\nstate uuid: Hv3uYt6eThqJLDSNT-ztYw\nfrom_diff: false\nmeta data version: 95\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.514Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [97] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.514Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.524Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.526Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.683Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.683Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=97}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.683Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.683Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=97}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.684Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [97] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.684Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [97] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.684Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=97, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.684Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [97]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.684Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=97}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.697Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=97}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.697Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.697Z", "log.level":"TRACE", "message":"lag detection for version 97 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.710Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.auditbeat@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.710Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [98] in for node version [8.0.0] with size [261]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.711Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [98] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.711Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.719Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=98, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 98\nstate uuid: eRbZXH2SSv-JpPhwm0tg-Q\nfrom_diff: false\nmeta data version: 96\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.723Z", "log.level":"TRACE", "message":"sending cluster state diff for version [98] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.724Z", "log.level":"DEBUG", "message":"received diff cluster state version [98] with uuid [eRbZXH2SSv-JpPhwm0tg-Q], diff size [261]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.735Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=98, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 98\nstate uuid: eRbZXH2SSv-JpPhwm0tg-Q\nfrom_diff: false\nmeta data version: 96\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.776Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [98] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.776Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.785Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.787Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.860Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.860Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=98}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.860Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.860Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=98}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.860Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [98] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.860Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [98] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.861Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=98, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.861Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [98]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.861Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=98}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.873Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=98}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.873Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.873Z", "log.level":"TRACE", "message":"lag detection for version 98 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.875Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.auditbeat@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.876Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [99] in for node version [8.0.0] with size [221]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.876Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [99] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.876Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.884Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=99, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 99\nstate uuid: sMgObkL9TiaefCNqY_iSDA\nfrom_diff: false\nmeta data version: 97\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.890Z", "log.level":"TRACE", "message":"sending cluster state diff for version [99] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.890Z", "log.level":"DEBUG", "message":"received diff cluster state version [99] with uuid [sMgObkL9TiaefCNqY_iSDA], diff size [221]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.898Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=99, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 99\nstate uuid: sMgObkL9TiaefCNqY_iSDA\nfrom_diff: false\nmeta data version: 97\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.929Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [99] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.929Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.938Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:08.940Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.051Z", "log.level":"DEBUG", "message":"writing cluster state took [205ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.051Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=99}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=99}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [99] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [99] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=99, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [99]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.052Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=99}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.065Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=99}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.066Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.066Z", "log.level":"TRACE", "message":"lag detection for version 99 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.076Z", "log.level": "INFO", "message":"adding index template [metrics-elastic_agent.auditbeat] for index patterns [metrics-elastic_agent.auditbeat-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.077Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [100] in for node version [8.0.0] with size [2068]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.077Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [100] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.077Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.086Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=100, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 100\nstate uuid: n-IwNfluS4eRa58TxAqF7w\nfrom_diff: false\nmeta data version: 98\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.092Z", "log.level":"TRACE", "message":"sending cluster state diff for version [100] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.093Z", "log.level":"DEBUG", "message":"received diff cluster state version [100] with uuid [n-IwNfluS4eRa58TxAqF7w], diff size [2068]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.101Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=100, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 100\nstate uuid: n-IwNfluS4eRa58TxAqF7w\nfrom_diff: false\nmeta data version: 98\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.132Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [100] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.132Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.150Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.152Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.153Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.153Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.230Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.230Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=100}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.230Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.230Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=100}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.231Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [100] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.231Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [100] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.231Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=100, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.231Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [100]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.231Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=100}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.245Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=100}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.245Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.245Z", "log.level":"TRACE", "message":"lag detection for version 100 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.255Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.268Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [101] in for node version [8.0.0] with size [249]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.269Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [101] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.287Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.296Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=101, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 101\nstate uuid: cLytBJqhSheQOztJRmUJpQ\nfrom_diff: false\nmeta data version: 99\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.345Z", "log.level":"TRACE", "message":"sending cluster state diff for version [101] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.346Z", "log.level":"DEBUG", "message":"received diff cluster state version [101] with uuid [cLytBJqhSheQOztJRmUJpQ], diff size [249]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.360Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=101, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 101\nstate uuid: cLytBJqhSheQOztJRmUJpQ\nfrom_diff: false\nmeta data version: 99\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.504Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [101] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.504Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.526Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.528Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.599Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=101}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=101}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [101] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [101] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=101, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.600Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [101]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.601Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=101}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.612Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=101}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.612Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.612Z", "log.level":"TRACE", "message":"lag detection for version 101 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.615Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.615Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [102] in for node version [8.0.0] with size [209]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.615Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [102] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.615Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.624Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=102, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 102\nstate uuid: I90EDf5sQ5K2-pjgSHTdcA\nfrom_diff: false\nmeta data version: 100\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.629Z", "log.level":"TRACE", "message":"sending cluster state diff for version [102] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.630Z", "log.level":"DEBUG", "message":"received diff cluster state version [102] with uuid [I90EDf5sQ5K2-pjgSHTdcA], diff size [209]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.639Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=102, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 102\nstate uuid: I90EDf5sQ5K2-pjgSHTdcA\nfrom_diff: false\nmeta data version: 100\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.668Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [102] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.668Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.678Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.680Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:09.771Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=102}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=102}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [102] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [102] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=102, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [102]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.773Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=102}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.786Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=102}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.786Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.786Z", "log.level":"TRACE", "message":"lag detection for version 102 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.788Z", "log.level": "INFO", "message":"adding component template [logs-system.application@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.788Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [103] in for node version [8.0.0] with size [218]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.789Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [103] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.789Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.798Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=103, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 103\nstate uuid: iREfdH4AQDGXWRJgt17Bdg\nfrom_diff: false\nmeta data version: 101\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.804Z", "log.level":"TRACE", "message":"sending cluster state diff for version [103] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.804Z", "log.level":"DEBUG", "message":"received diff cluster state version [103] with uuid [iREfdH4AQDGXWRJgt17Bdg], diff size [218]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:09.819Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=103, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 103\nstate uuid: iREfdH4AQDGXWRJgt17Bdg\nfrom_diff: false\nmeta data version: 101\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.667Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [103] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.667Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.679Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:10.681Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.681Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.681Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.682Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.682Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.682Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.682Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.682Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.682Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:10.756Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.756Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=103}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=103}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [103] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [103] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=103, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [103]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.757Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=103}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.769Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=103}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.770Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.770Z", "log.level":"TRACE", "message":"lag detection for version 103 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.775Z", "log.level": "INFO", "message":"adding index template [logs-elastic_agent] for index patterns [logs-elastic_agent-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.776Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [104] in for node version [8.0.0] with size [1299]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.776Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [104] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.776Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.785Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=104, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 104\nstate uuid: TKhKGEXcT5GEjzRU0bpVQg\nfrom_diff: false\nmeta data version: 102\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.792Z", "log.level":"TRACE", "message":"sending cluster state diff for version [104] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.793Z", "log.level":"DEBUG", "message":"received diff cluster state version [104] with uuid [TKhKGEXcT5GEjzRU0bpVQg], diff size [1299]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.801Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=104, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 104\nstate uuid: TKhKGEXcT5GEjzRU0bpVQg\nfrom_diff: false\nmeta data version: 102\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.844Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [104] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.844Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.854Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:10.855Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.856Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:10.984Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.984Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=104}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.984Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.984Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=104}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.984Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [104] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.984Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [104] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.985Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=104, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.985Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [104]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.985Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=104}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.996Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=104}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.996Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:10.996Z", "log.level":"TRACE", "message":"lag detection for version 104 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.004Z", "log.level": "INFO", "message":"adding index template [logs-system.application] for index patterns [logs-system.application-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.005Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [105] in for node version [8.0.0] with size [3412]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.005Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [105] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.005Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.015Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=105, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 105\nstate uuid: OV88BeLuRcaS60yyozH1ag\nfrom_diff: false\nmeta data version: 103\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.022Z", "log.level":"TRACE", "message":"sending cluster state diff for version [105] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.023Z", "log.level":"DEBUG", "message":"received diff cluster state version [105] with uuid [OV88BeLuRcaS60yyozH1ag], diff size [3412]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.032Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=105, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 105\nstate uuid: OV88BeLuRcaS60yyozH1ag\nfrom_diff: false\nmeta data version: 103\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.133Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [105] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.133Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.143Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:11.144Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.144Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.144Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.144Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.144Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.145Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.145Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.145Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.145Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:11.620Z", "log.level":"DEBUG", "message":"writing cluster state took [404ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.620Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=105}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.620Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.620Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=105}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.621Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [105] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.621Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [105] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.621Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=105, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.621Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [105]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.621Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=105}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.633Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=105}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.633Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.633Z", "log.level":"TRACE", "message":"lag detection for version 105 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.635Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.elastic_agent@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.636Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [106] in for node version [8.0.0] with size [254]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.636Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [106] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.636Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.645Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=106, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 106\nstate uuid: EQvb-sUVRxuMKpPDo58Kbw\nfrom_diff: false\nmeta data version: 104\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.650Z", "log.level":"TRACE", "message":"sending cluster state diff for version [106] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.651Z", "log.level":"DEBUG", "message":"received diff cluster state version [106] with uuid [EQvb-sUVRxuMKpPDo58Kbw], diff size [254]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.659Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=106, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 106\nstate uuid: EQvb-sUVRxuMKpPDo58Kbw\nfrom_diff: false\nmeta data version: 104\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.751Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [106] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.751Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.761Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:11.762Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.762Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.762Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.762Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.763Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.763Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.763Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.763Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.763Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=106}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=106}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [106] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [106] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.833Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=106, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.834Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [106]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.834Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=106}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.845Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=106}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.845Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.845Z", "log.level":"TRACE", "message":"lag detection for version 106 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.847Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.elastic_agent@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.848Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [107] in for node version [8.0.0] with size [214]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.848Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [107] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.848Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.856Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=107, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 107\nstate uuid: g23sxM3rS2-J_rOKmBGBxw\nfrom_diff: false\nmeta data version: 105\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.862Z", "log.level":"TRACE", "message":"sending cluster state diff for version [107] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.862Z", "log.level":"DEBUG", "message":"received diff cluster state version [107] with uuid [g23sxM3rS2-J_rOKmBGBxw], diff size [214]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.871Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=107, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 107\nstate uuid: g23sxM3rS2-J_rOKmBGBxw\nfrom_diff: false\nmeta data version: 105\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.972Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [107] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.972Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.982Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:11.983Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.983Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:11.984Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.052Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.052Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=107}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.052Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.052Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=107}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.052Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [107] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.052Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [107] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.053Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=107, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.053Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [107]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.053Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=107}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.063Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=107}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.064Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.064Z", "log.level":"TRACE", "message":"lag detection for version 107 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.066Z", "log.level": "INFO", "message":"adding component template [logs-system.auth@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.066Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [108] in for node version [8.0.0] with size [206]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.066Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [108] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.067Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.075Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=108, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 108\nstate uuid: cXQWjj_4SrKdLpRr3KtJ5g\nfrom_diff: false\nmeta data version: 106\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.084Z", "log.level":"TRACE", "message":"sending cluster state diff for version [108] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.085Z", "log.level":"DEBUG", "message":"received diff cluster state version [108] with uuid [cXQWjj_4SrKdLpRr3KtJ5g], diff size [206]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.093Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=108, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 108\nstate uuid: cXQWjj_4SrKdLpRr3KtJ5g\nfrom_diff: false\nmeta data version: 106\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.171Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [108] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.171Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.181Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.182Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.182Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.182Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.182Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.183Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.183Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.183Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.183Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.183Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=108}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=108}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [108] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [108] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.253Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=108, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.254Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [108]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.254Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=108}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.264Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=108}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.265Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.265Z", "log.level":"TRACE", "message":"lag detection for version 108 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.271Z", "log.level": "INFO", "message":"adding index template [metrics-elastic_agent.elastic_agent] for index patterns [metrics-elastic_agent.elastic_agent-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.271Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [109] in for node version [8.0.0] with size [2519]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.272Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [109] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.272Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.281Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=109, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 109\nstate uuid: QOnHTTpLQWiYj7ErFIXqnQ\nfrom_diff: false\nmeta data version: 107\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.324Z", "log.level":"TRACE", "message":"sending cluster state diff for version [109] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.324Z", "log.level":"DEBUG", "message":"received diff cluster state version [109] with uuid [QOnHTTpLQWiYj7ErFIXqnQ], diff size [2519]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.333Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=109, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 109\nstate uuid: QOnHTTpLQWiYj7ErFIXqnQ\nfrom_diff: false\nmeta data version: 107\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.435Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [109] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.435Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.456Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.458Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.459Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.459Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.459Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.460Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.460Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.460Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.460Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.460Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=109}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=109}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [109] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [109] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=109, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.591Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [109]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.592Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=109}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.603Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=109}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.603Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.603Z", "log.level":"TRACE", "message":"lag detection for version 109 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.609Z", "log.level": "INFO", "message":"adding index template [logs-system.auth] for index patterns [logs-system.auth-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.609Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [110] in for node version [8.0.0] with size [1935]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.609Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [110] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.609Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.619Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=110, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 110\nstate uuid: xBu4I6xJQgSeWz--0ejOow\nfrom_diff: false\nmeta data version: 108\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.745Z", "log.level":"TRACE", "message":"sending cluster state diff for version [110] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.745Z", "log.level":"DEBUG", "message":"received diff cluster state version [110] with uuid [xBu4I6xJQgSeWz--0ejOow], diff size [1935]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.754Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=110, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 110\nstate uuid: xBu4I6xJQgSeWz--0ejOow\nfrom_diff: false\nmeta data version: 108\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.803Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [110] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.803Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.814Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.815Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:12.885Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=110}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=110}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [110] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [110] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=110, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [110]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.886Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=110}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.898Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=110}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.898Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.898Z", "log.level":"TRACE", "message":"lag detection for version 110 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.900Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.endpoint_security@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.901Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [111] in for node version [8.0.0] with size [268]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.901Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [111] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.901Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.911Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=111, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 111\nstate uuid: nmuhcggGR5GIEQ5tSVDFaw\nfrom_diff: false\nmeta data version: 109\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.981Z", "log.level":"TRACE", "message":"sending cluster state diff for version [111] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.981Z", "log.level":"DEBUG", "message":"received diff cluster state version [111] with uuid [nmuhcggGR5GIEQ5tSVDFaw], diff size [268]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:12.994Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=111, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 111\nstate uuid: nmuhcggGR5GIEQ5tSVDFaw\nfrom_diff: false\nmeta data version: 109\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.047Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [111] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.047Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.059Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.061Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.062Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.135Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.135Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=111}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.135Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.136Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=111}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.136Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [111] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.136Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [111] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.136Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=111, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.136Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [111]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.136Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=111}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.148Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=111}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.148Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.148Z", "log.level":"TRACE", "message":"lag detection for version 111 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.151Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.endpoint_security@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.151Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [112] in for node version [8.0.0] with size [227]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.151Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [112] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.151Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.161Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=112, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 112\nstate uuid: LZWKWawoTN-ZKaUHX9zf9A\nfrom_diff: false\nmeta data version: 110\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.219Z", "log.level":"TRACE", "message":"sending cluster state diff for version [112] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.220Z", "log.level":"DEBUG", "message":"received diff cluster state version [112] with uuid [LZWKWawoTN-ZKaUHX9zf9A], diff size [227]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.230Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=112, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 112\nstate uuid: LZWKWawoTN-ZKaUHX9zf9A\nfrom_diff: false\nmeta data version: 110\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.281Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [112] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.281Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.294Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.296Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.296Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.296Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.296Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.296Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.297Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.297Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.297Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.297Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.374Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.374Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=112}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.374Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.374Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=112}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.374Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [112] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.375Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [112] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.375Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=112, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.375Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [112]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.375Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=112}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.395Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=112}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.395Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.396Z", "log.level":"TRACE", "message":"lag detection for version 112 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.399Z", "log.level": "INFO", "message":"adding component template [metrics-system.core@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.399Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [113] in for node version [8.0.0] with size [210]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.400Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [113] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.400Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.415Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=113, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 113\nstate uuid: TgXZz0zEQHusE_tVqP_m6Q\nfrom_diff: false\nmeta data version: 111\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.616Z", "log.level":"TRACE", "message":"sending cluster state diff for version [113] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.616Z", "log.level":"DEBUG", "message":"received diff cluster state version [113] with uuid [TgXZz0zEQHusE_tVqP_m6Q], diff size [210]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.648Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=113, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 113\nstate uuid: TgXZz0zEQHusE_tVqP_m6Q\nfrom_diff: false\nmeta data version: 111\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.703Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [113] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.703Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.716Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.717Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.717Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.717Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.717Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.717Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.718Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.718Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.718Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.718Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.789Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.789Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=113}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.789Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.789Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=113}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.789Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [113] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.789Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [113] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.790Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=113, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.790Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [113]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.790Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=113}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.804Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=113}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.804Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.804Z", "log.level":"TRACE", "message":"lag detection for version 113 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.809Z", "log.level": "INFO", "message":"adding index template [metrics-elastic_agent.endpoint_security] for index patterns [metrics-elastic_agent.endpoint_security-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.810Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [114] in for node version [8.0.0] with size [1391]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.810Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [114] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.810Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.821Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=114, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 114\nstate uuid: jaROPDTeTkKTSOl3CSTokA\nfrom_diff: false\nmeta data version: 112\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.877Z", "log.level":"TRACE", "message":"sending cluster state diff for version [114] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.877Z", "log.level":"DEBUG", "message":"received diff cluster state version [114] with uuid [jaROPDTeTkKTSOl3CSTokA], diff size [1391]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.888Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=114, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 114\nstate uuid: jaROPDTeTkKTSOl3CSTokA\nfrom_diff: false\nmeta data version: 112\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.946Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [114] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.946Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.957Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:13.958Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:13.959Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.030Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=114}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=114}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [114] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [114] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=114, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [114]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.031Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=114}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.042Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=114}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.043Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.043Z", "log.level":"TRACE", "message":"lag detection for version 114 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.048Z", "log.level": "INFO", "message":"adding index template [metrics-system.core] for index patterns [metrics-system.core-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.048Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [115] in for node version [8.0.0] with size [1401]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.048Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [115] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.049Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.058Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=115, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 115\nstate uuid: WHeDkhSvRkylDgJ--F0Ovg\nfrom_diff: false\nmeta data version: 113\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.112Z", "log.level":"TRACE", "message":"sending cluster state diff for version [115] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.113Z", "log.level":"DEBUG", "message":"received diff cluster state version [115] with uuid [WHeDkhSvRkylDgJ--F0Ovg], diff size [1401]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.122Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=115, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 115\nstate uuid: WHeDkhSvRkylDgJ--F0Ovg\nfrom_diff: false\nmeta data version: 113\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.165Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [115] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.165Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.176Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.177Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.178Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.253Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.253Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=115}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=115}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [115] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [115] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=115, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [115]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.254Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=115}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.271Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=115}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.271Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.271Z", "log.level":"TRACE", "message":"lag detection for version 115 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.274Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.endpoint_security@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.275Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [116] in for node version [8.0.0] with size [266]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.275Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [116] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.275Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.288Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=116, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 116\nstate uuid: RZKL49jvRH2v3e6OfuESPA\nfrom_diff: false\nmeta data version: 114\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.551Z", "log.level":"TRACE", "message":"sending cluster state diff for version [116] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.552Z", "log.level":"DEBUG", "message":"received diff cluster state version [116] with uuid [RZKL49jvRH2v3e6OfuESPA], diff size [266]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.562Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=116, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 116\nstate uuid: RZKL49jvRH2v3e6OfuESPA\nfrom_diff: false\nmeta data version: 114\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.602Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [116] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.603Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.618Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.619Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.620Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.696Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.696Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=116}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.696Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.697Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=116}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.697Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [116] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.697Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [116] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.697Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=116, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.697Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [116]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.697Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=116}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.708Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=116}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.709Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.709Z", "log.level":"TRACE", "message":"lag detection for version 116 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.711Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.endpoint_security@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.712Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [117] in for node version [8.0.0] with size [225]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.712Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [117] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.712Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.721Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=117, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 117\nstate uuid: XMlAeJsiQCut_4Y_j1CezA\nfrom_diff: false\nmeta data version: 115\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.766Z", "log.level":"TRACE", "message":"sending cluster state diff for version [117] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.766Z", "log.level":"DEBUG", "message":"received diff cluster state version [117] with uuid [XMlAeJsiQCut_4Y_j1CezA], diff size [225]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.777Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=117, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 117\nstate uuid: XMlAeJsiQCut_4Y_j1CezA\nfrom_diff: false\nmeta data version: 115\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.817Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [117] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.817Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.828Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.829Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.830Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:14.884Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.884Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=117}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.884Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.884Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=117}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.885Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [117] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.885Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [117] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.885Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=117, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.885Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [117]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.885Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=117}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.897Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=117}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.898Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.898Z", "log.level":"TRACE", "message":"lag detection for version 117 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.900Z", "log.level": "INFO", "message":"adding component template [metrics-system.cpu@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.901Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [118] in for node version [8.0.0] with size [206]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.901Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [118] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.901Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.912Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=118, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 118\nstate uuid: J8sVFC9bTPmkVVSreta2tQ\nfrom_diff: false\nmeta data version: 116\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.987Z", "log.level":"TRACE", "message":"sending cluster state diff for version [118] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:14.988Z", "log.level":"DEBUG", "message":"received diff cluster state version [118] with uuid [J8sVFC9bTPmkVVSreta2tQ], diff size [206]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.001Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=118, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 118\nstate uuid: J8sVFC9bTPmkVVSreta2tQ\nfrom_diff: false\nmeta data version: 116\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.054Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [118] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.054Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.066Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.067Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.146Z", "log.level":"DEBUG", "message":"writing cluster state took [200ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.146Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=118}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.146Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.146Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=118}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.146Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [118] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.146Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [118] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.147Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=118, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.147Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [118]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.147Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=118}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.160Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=118}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.160Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.160Z", "log.level":"TRACE", "message":"lag detection for version 118 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.166Z", "log.level": "INFO", "message":"adding index template [logs-elastic_agent.endpoint_security] for index patterns [logs-elastic_agent.endpoint_security-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.166Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [119] in for node version [8.0.0] with size [1314]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.167Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [119] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.167Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.180Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=119, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 119\nstate uuid: lex8nQ_5ReG4PDS7QOgqUQ\nfrom_diff: false\nmeta data version: 117\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.329Z", "log.level":"TRACE", "message":"sending cluster state diff for version [119] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.330Z", "log.level":"DEBUG", "message":"received diff cluster state version [119] with uuid [lex8nQ_5ReG4PDS7QOgqUQ], diff size [1314]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.346Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=119, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 119\nstate uuid: lex8nQ_5ReG4PDS7QOgqUQ\nfrom_diff: false\nmeta data version: 117\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.383Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [119] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.383Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.396Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.397Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.397Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.397Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.397Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.397Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.398Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.398Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.398Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.398Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.469Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.469Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=119}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=119}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [119] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [119] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=119, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [119]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.470Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=119}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.483Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=119}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.483Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.483Z", "log.level":"TRACE", "message":"lag detection for version 119 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.489Z", "log.level": "INFO", "message":"adding index template [metrics-system.cpu] for index patterns [metrics-system.cpu-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.489Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [120] in for node version [8.0.0] with size [1467]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.490Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [120] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.490Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.500Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=120, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 120\nstate uuid: OEAwdqfJSSiA8Py51pJO2Q\nfrom_diff: false\nmeta data version: 118\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.540Z", "log.level":"TRACE", "message":"sending cluster state diff for version [120] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.541Z", "log.level":"DEBUG", "message":"received diff cluster state version [120] with uuid [OEAwdqfJSSiA8Py51pJO2Q], diff size [1467]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.551Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=120, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 120\nstate uuid: OEAwdqfJSSiA8Py51pJO2Q\nfrom_diff: false\nmeta data version: 118\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.588Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [120] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.588Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.599Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.600Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.769Z", "log.level":"DEBUG", "message":"writing cluster state took [203ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.769Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=120}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.770Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.770Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=120}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.770Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [120] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.770Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [120] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.770Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=120, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.770Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [120]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.771Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=120}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.784Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=120}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.784Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.784Z", "log.level":"TRACE", "message":"lag detection for version 120 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.786Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.filebeat@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.787Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [121] in for node version [8.0.0] with size [258]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.787Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [121] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.787Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.800Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=121, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 121\nstate uuid: _Zf66GC3T4OXb3N234i9sQ\nfrom_diff: false\nmeta data version: 119\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.836Z", "log.level":"TRACE", "message":"sending cluster state diff for version [121] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.837Z", "log.level":"DEBUG", "message":"received diff cluster state version [121] with uuid [_Zf66GC3T4OXb3N234i9sQ], diff size [258]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.846Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=121, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 121\nstate uuid: _Zf66GC3T4OXb3N234i9sQ\nfrom_diff: false\nmeta data version: 119\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.889Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [121] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.889Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.900Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.901Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"DEBUG", "message":"writing cluster state took [204ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=121}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=121}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [121] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [121] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.997Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=121, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.998Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [121]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:15.998Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=121}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.013Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=121}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.013Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.013Z", "log.level":"TRACE", "message":"lag detection for version 121 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.016Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.filebeat@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.016Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [122] in for node version [8.0.0] with size [215]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.016Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [122] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.016Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.029Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=122, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 122\nstate uuid: 2HZkk4YATsyWErykrtGSTQ\nfrom_diff: false\nmeta data version: 120\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.122Z", "log.level":"TRACE", "message":"sending cluster state diff for version [122] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.123Z", "log.level":"DEBUG", "message":"received diff cluster state version [122] with uuid [2HZkk4YATsyWErykrtGSTQ], diff size [215]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.135Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=122, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 122\nstate uuid: 2HZkk4YATsyWErykrtGSTQ\nfrom_diff: false\nmeta data version: 120\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.233Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [122] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.233Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.245Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.252Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.253Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.253Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:16.401Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.401Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=122}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.401Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.402Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=122}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.402Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [122] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.402Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [122] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.402Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=122, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.402Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [122]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.402Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=122}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.414Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=122}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.415Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.415Z", "log.level":"TRACE", "message":"lag detection for version 122 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.416Z", "log.level": "INFO", "message":"adding component template [metrics-system.diskio@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.417Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [123] in for node version [8.0.0] with size [215]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.417Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [123] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.417Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.427Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=123, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 123\nstate uuid: wd0mHWfQSOOmJbRPO3bDMg\nfrom_diff: false\nmeta data version: 121\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.459Z", "log.level":"TRACE", "message":"sending cluster state diff for version [123] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.459Z", "log.level":"DEBUG", "message":"received diff cluster state version [123] with uuid [wd0mHWfQSOOmJbRPO3bDMg], diff size [215]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.471Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=123, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 123\nstate uuid: wd0mHWfQSOOmJbRPO3bDMg\nfrom_diff: false\nmeta data version: 121\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.509Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [123] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.509Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.520Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:16.521Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.521Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.522Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:16.633Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.634Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=123}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.634Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.634Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=123}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.634Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [123] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.634Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [123] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.634Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=123, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.635Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [123]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.635Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=123}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.647Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=123}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.647Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.647Z", "log.level":"TRACE", "message":"lag detection for version 123 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.652Z", "log.level": "INFO", "message":"adding index template [logs-elastic_agent.filebeat] for index patterns [logs-elastic_agent.filebeat-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.653Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [124] in for node version [8.0.0] with size [1307]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.653Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [124] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.653Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.663Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=124, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 124\nstate uuid: 3SmIoalSTx-p4AdjU3gtWw\nfrom_diff: false\nmeta data version: 122\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.755Z", "log.level":"TRACE", "message":"sending cluster state diff for version [124] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.756Z", "log.level":"DEBUG", "message":"received diff cluster state version [124] with uuid [3SmIoalSTx-p4AdjU3gtWw], diff size [1307]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.768Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=124, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 124\nstate uuid: 3SmIoalSTx-p4AdjU3gtWw\nfrom_diff: false\nmeta data version: 122\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.901Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [124] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.901Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.925Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:16.926Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.926Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.926Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.926Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.926Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.927Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.927Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.927Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:16.927Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.000Z", "log.level":"DEBUG", "message":"writing cluster state took [205ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.000Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=124}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.000Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.001Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=124}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.001Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [124] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.001Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [124] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.001Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=124, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.001Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [124]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.001Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=124}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.013Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=124}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.013Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.013Z", "log.level":"TRACE", "message":"lag detection for version 124 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.018Z", "log.level": "INFO", "message":"adding index template [metrics-system.diskio] for index patterns [metrics-system.diskio-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.019Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [125] in for node version [8.0.0] with size [1504]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.019Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [125] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.019Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.029Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=125, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 125\nstate uuid: 9AHcQZ4OS1WnTMU3-wyHPw\nfrom_diff: false\nmeta data version: 123\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.067Z", "log.level":"TRACE", "message":"sending cluster state diff for version [125] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.068Z", "log.level":"DEBUG", "message":"received diff cluster state version [125] with uuid [9AHcQZ4OS1WnTMU3-wyHPw], diff size [1504]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.082Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=125, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 125\nstate uuid: 9AHcQZ4OS1WnTMU3-wyHPw\nfrom_diff: false\nmeta data version: 123\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.121Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [125] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.121Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.134Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.136Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.208Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.208Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=125}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=125}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [125] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [125] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=125, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [125]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.209Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=125}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.223Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=125}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.224Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.224Z", "log.level":"TRACE", "message":"lag detection for version 125 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.226Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.filebeat@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.227Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [126] in for node version [8.0.0] with size [260]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.227Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [126] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.227Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.240Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=126, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 126\nstate uuid: 3rt5QhT0QNWgtzxV-l3_7g\nfrom_diff: false\nmeta data version: 124\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.272Z", "log.level":"TRACE", "message":"sending cluster state diff for version [126] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.272Z", "log.level":"DEBUG", "message":"received diff cluster state version [126] with uuid [3rt5QhT0QNWgtzxV-l3_7g], diff size [260]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.283Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=126, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 126\nstate uuid: 3rt5QhT0QNWgtzxV-l3_7g\nfrom_diff: false\nmeta data version: 124\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.327Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [126] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.327Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.348Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.350Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.468Z", "log.level":"DEBUG", "message":"writing cluster state took [201ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.468Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=126}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.468Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.468Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=126}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.469Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [126] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.469Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [126] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.469Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=126, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.469Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [126]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.469Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=126}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.482Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=126}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.483Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.483Z", "log.level":"TRACE", "message":"lag detection for version 126 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.485Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.filebeat@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.486Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [127] in for node version [8.0.0] with size [220]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.486Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [127] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.486Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.497Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=127, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 127\nstate uuid: -0JYFzuxQDaN1uhAbEg5SQ\nfrom_diff: false\nmeta data version: 125\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.564Z", "log.level":"TRACE", "message":"sending cluster state diff for version [127] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.565Z", "log.level":"DEBUG", "message":"received diff cluster state version [127] with uuid [-0JYFzuxQDaN1uhAbEg5SQ], diff size [220]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.575Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=127, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 127\nstate uuid: -0JYFzuxQDaN1uhAbEg5SQ\nfrom_diff: false\nmeta data version: 125\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.616Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [127] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.616Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.628Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.629Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.719Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.719Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=127}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.719Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.719Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=127}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.719Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [127] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.720Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [127] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.720Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=127, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.720Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [127]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.720Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=127}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.733Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=127}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.733Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.733Z", "log.level":"TRACE", "message":"lag detection for version 127 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.735Z", "log.level": "INFO", "message":"adding component template [metrics-system.filesystem@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.736Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [128] in for node version [8.0.0] with size [215]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.736Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [128] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.736Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.747Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=128, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 128\nstate uuid: 8PfFYKahQOinnhcgaywcMg\nfrom_diff: false\nmeta data version: 126\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.781Z", "log.level":"TRACE", "message":"sending cluster state diff for version [128] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.781Z", "log.level":"DEBUG", "message":"received diff cluster state version [128] with uuid [8PfFYKahQOinnhcgaywcMg], diff size [215]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.792Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=128, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 128\nstate uuid: 8PfFYKahQOinnhcgaywcMg\nfrom_diff: false\nmeta data version: 126\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.839Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [128] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.839Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.850Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.852Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:17.922Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.922Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=128}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.922Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.922Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=128}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.922Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [128] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.922Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [128] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.923Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=128, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.923Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [128]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.923Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=128}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.935Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=128}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.935Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.935Z", "log.level":"TRACE", "message":"lag detection for version 128 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.941Z", "log.level": "INFO", "message":"adding index template [metrics-elastic_agent.filebeat] for index patterns [metrics-elastic_agent.filebeat-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.942Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [129] in for node version [8.0.0] with size [2067]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.942Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [129] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.942Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.952Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=129, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 129\nstate uuid: U3YLnaMkTHSLWGLYRCTxpA\nfrom_diff: false\nmeta data version: 127\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.989Z", "log.level":"TRACE", "message":"sending cluster state diff for version [129] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:17.990Z", "log.level":"DEBUG", "message":"received diff cluster state version [129] with uuid [U3YLnaMkTHSLWGLYRCTxpA], diff size [2067]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.000Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=129, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 129\nstate uuid: U3YLnaMkTHSLWGLYRCTxpA\nfrom_diff: false\nmeta data version: 127\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.033Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [129] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.033Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.045Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.046Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.124Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.124Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=129}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.124Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.124Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=129}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.124Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [129] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.125Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [129] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.125Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=129, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.125Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [129]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.125Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=129}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.138Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=129}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.139Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.139Z", "log.level":"TRACE", "message":"lag detection for version 129 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.144Z", "log.level": "INFO", "message":"adding index template [metrics-system.filesystem] for index patterns [metrics-system.filesystem-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.145Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [130] in for node version [8.0.0] with size [1405]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.145Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [130] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.145Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.157Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=130, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 130\nstate uuid: V7j5DKHuQgq432KpB85YGg\nfrom_diff: false\nmeta data version: 128\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.289Z", "log.level":"TRACE", "message":"sending cluster state diff for version [130] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.289Z", "log.level":"DEBUG", "message":"received diff cluster state version [130] with uuid [V7j5DKHuQgq432KpB85YGg], diff size [1405]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.301Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=130, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 130\nstate uuid: V7j5DKHuQgq432KpB85YGg\nfrom_diff: false\nmeta data version: 128\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.343Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [130] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.343Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.355Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.356Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.460Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.460Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=130}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=130}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [130] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [130] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=130, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [130]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.461Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=130}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.475Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=130}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.475Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.475Z", "log.level":"TRACE", "message":"lag detection for version 130 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.477Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.fleet_server@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.478Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [131] in for node version [8.0.0] with size [262]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.478Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [131] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.478Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.490Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=131, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 131\nstate uuid: NziEQ8U6ShGwAf__0D8Rtg\nfrom_diff: false\nmeta data version: 129\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.523Z", "log.level":"TRACE", "message":"sending cluster state diff for version [131] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.524Z", "log.level":"DEBUG", "message":"received diff cluster state version [131] with uuid [NziEQ8U6ShGwAf__0D8Rtg], diff size [262]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.536Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=131, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 131\nstate uuid: NziEQ8U6ShGwAf__0D8Rtg\nfrom_diff: false\nmeta data version: 129\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.574Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [131] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.574Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.586Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.587Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.588Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.660Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.660Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=131}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.660Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.660Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=131}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.660Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [131] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.660Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [131] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.661Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=131, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.661Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [131]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.661Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=131}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.672Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=131}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.672Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.672Z", "log.level":"TRACE", "message":"lag detection for version 131 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.674Z", "log.level": "INFO", "message":"adding component template [logs-elastic_agent.fleet_server@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.674Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [132] in for node version [8.0.0] with size [222]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.674Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [132] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.674Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.685Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=132, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 132\nstate uuid: wt5uGuDxR7qvXArf-QJKew\nfrom_diff: false\nmeta data version: 130\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.732Z", "log.level":"TRACE", "message":"sending cluster state diff for version [132] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.732Z", "log.level":"DEBUG", "message":"received diff cluster state version [132] with uuid [wt5uGuDxR7qvXArf-QJKew], diff size [222]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.752Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=132, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 132\nstate uuid: wt5uGuDxR7qvXArf-QJKew\nfrom_diff: false\nmeta data version: 130\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.920Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [132] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.921Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.940Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:18.941Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.941Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:18.942Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.019Z", "log.level":"DEBUG", "message":"writing cluster state took [205ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=132}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=132}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [132] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [132] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=132, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.020Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [132]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.021Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=132}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.038Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=132}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.038Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.039Z", "log.level":"TRACE", "message":"lag detection for version 132 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.041Z", "log.level": "INFO", "message":"adding component template [metrics-system.fsstat@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.041Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [133] in for node version [8.0.0] with size [216]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.041Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [133] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.042Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.054Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=133, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 133\nstate uuid: N7SroOjZRPC6Yw5Lrpqi7g\nfrom_diff: false\nmeta data version: 131\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.094Z", "log.level":"TRACE", "message":"sending cluster state diff for version [133] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.094Z", "log.level":"DEBUG", "message":"received diff cluster state version [133] with uuid [N7SroOjZRPC6Yw5Lrpqi7g], diff size [216]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.106Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=133, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 133\nstate uuid: N7SroOjZRPC6Yw5Lrpqi7g\nfrom_diff: false\nmeta data version: 131\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.171Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [133] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.171Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.184Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.186Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.258Z", "log.level":"DEBUG", "message":"writing cluster state took [205ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.258Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=133}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.259Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.259Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=133}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.259Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [133] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.259Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [133] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.259Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=133, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.259Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [133]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.260Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=133}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.272Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=133}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.273Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.273Z", "log.level":"TRACE", "message":"lag detection for version 133 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.277Z", "log.level": "INFO", "message":"adding index template [logs-elastic_agent.fleet_server] for index patterns [logs-elastic_agent.fleet_server-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.278Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [134] in for node version [8.0.0] with size [1310]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.278Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [134] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.278Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.291Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=134, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 134\nstate uuid: ND3moGUmRW6kBNO_B5EGFQ\nfrom_diff: false\nmeta data version: 132\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.321Z", "log.level":"TRACE", "message":"sending cluster state diff for version [134] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.322Z", "log.level":"DEBUG", "message":"received diff cluster state version [134] with uuid [ND3moGUmRW6kBNO_B5EGFQ], diff size [1310]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.336Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=134, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 134\nstate uuid: ND3moGUmRW6kBNO_B5EGFQ\nfrom_diff: false\nmeta data version: 132\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.403Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [134] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.403Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.425Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.427Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.505Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=134}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=134}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [134] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [134] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=134, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [134]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.506Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=134}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.519Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=134}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.519Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.519Z", "log.level":"TRACE", "message":"lag detection for version 134 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.524Z", "log.level": "INFO", "message":"adding index template [metrics-system.fsstat] for index patterns [metrics-system.fsstat-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.525Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [135] in for node version [8.0.0] with size [1324]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.525Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [135] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.525Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.539Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=135, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 135\nstate uuid: pWxW3jSYQwS_4KOoFxq7zg\nfrom_diff: false\nmeta data version: 133\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.649Z", "log.level":"TRACE", "message":"sending cluster state diff for version [135] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.649Z", "log.level":"DEBUG", "message":"received diff cluster state version [135] with uuid [pWxW3jSYQwS_4KOoFxq7zg], diff size [1324]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.660Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=135, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 135\nstate uuid: pWxW3jSYQwS_4KOoFxq7zg\nfrom_diff: false\nmeta data version: 133\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.703Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [135] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.703Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.715Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.716Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.788Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.788Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=135}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.788Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.789Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=135}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.789Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [135] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.789Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [135] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#2]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.789Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=135, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.789Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [135]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.789Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=135}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.812Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=135}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.813Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.813Z", "log.level":"TRACE", "message":"lag detection for version 135 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.815Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.fleet_server@mappings]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.816Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [136] in for node version [8.0.0] with size [264]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.816Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [136] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.816Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.826Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=136, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 136\nstate uuid: eQcpB4CHQZek6IUsTJOD7A\nfrom_diff: false\nmeta data version: 134\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.859Z", "log.level":"TRACE", "message":"sending cluster state diff for version [136] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.859Z", "log.level":"DEBUG", "message":"received diff cluster state version [136] with uuid [eQcpB4CHQZek6IUsTJOD7A], diff size [264]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.870Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=136, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 136\nstate uuid: eQcpB4CHQZek6IUsTJOD7A\nfrom_diff: false\nmeta data version: 134\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.928Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [136] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.929Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.945Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:19.946Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:19.947Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.038Z", "log.level":"DEBUG", "message":"writing cluster state took [205ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.039Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=136}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.039Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.039Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=136}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.039Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [136] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.039Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [136] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.040Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=136, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.040Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [136]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.040Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=136}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#11]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.053Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=136}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.053Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.053Z", "log.level":"TRACE", "message":"lag detection for version 136 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.055Z", "log.level": "INFO", "message":"adding component template [metrics-elastic_agent.fleet_server@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.056Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [137] in for node version [8.0.0] with size [224]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.056Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [137] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.056Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.068Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=137, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 137\nstate uuid: Pzz5Sb00SNuswqPTB8zPOA\nfrom_diff: false\nmeta data version: 135\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.106Z", "log.level":"TRACE", "message":"sending cluster state diff for version [137] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.107Z", "log.level":"DEBUG", "message":"received diff cluster state version [137] with uuid [Pzz5Sb00SNuswqPTB8zPOA], diff size [224]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.118Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=137, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 137\nstate uuid: Pzz5Sb00SNuswqPTB8zPOA\nfrom_diff: false\nmeta data version: 135\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.267Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [137] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.268Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.282Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.283Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.354Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.354Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=137}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#3]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.355Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.355Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=137}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.355Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [137] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.355Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [137] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.355Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=137, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.355Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [137]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.356Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=137}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.370Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=137}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.370Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.371Z", "log.level":"TRACE", "message":"lag detection for version 137 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.372Z", "log.level": "INFO", "message":"adding component template [metrics-system.load@custom]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.373Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [138] in for node version [8.0.0] with size [213]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.373Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [138] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.373Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.386Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=138, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 138\nstate uuid: PJbQIzA3RzWtHH5gcVxWkg\nfrom_diff: false\nmeta data version: 136\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.load@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.428Z", "log.level":"TRACE", "message":"sending cluster state diff for version [138] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.428Z", "log.level":"DEBUG", "message":"received diff cluster state version [138] with uuid [PJbQIzA3RzWtHH5gcVxWkg], diff size [213]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.443Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=138, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 138\nstate uuid: PJbQIzA3RzWtHH5gcVxWkg\nfrom_diff: false\nmeta data version: 136\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.load@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.504Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [138] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.505Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.517Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.518Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.519Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.589Z", "log.level":"DEBUG", "message":"writing cluster state took [0ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.589Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=138}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#8]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.589Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.589Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=138}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.589Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [138] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.589Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [138] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#5]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.590Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=138, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.590Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [138]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.590Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=138}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#9]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.601Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=138}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.601Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.601Z", "log.level":"TRACE", "message":"lag detection for version 138 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.606Z", "log.level": "INFO", "message":"adding index template [metrics-elastic_agent.fleet_server] for index patterns [metrics-elastic_agent.fleet_server-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.607Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [139] in for node version [8.0.0] with size [2073]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.607Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [139] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.607Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.618Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=139, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 139\nstate uuid: 08RLR1lcT6qYchgSqOw28g\nfrom_diff: false\nmeta data version: 137\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.load@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.fleet_server\":{\"index_patterns\":[\"metrics-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.fleet_server@mappings\",\"metrics-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }} to [PublicationTarget{discoveryNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, state=NOT_STARTED, ackIsPending=true}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.650Z", "log.level":"TRACE", "message":"sending cluster state diff for version [139] to [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.650Z", "log.level":"DEBUG", "message":"received diff cluster state version [139] with uuid [08RLR1lcT6qYchgSqOw28g], diff size [2073]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.661Z", "log.level":"TRACE", "message":"handlePublishRequest: handling [PublishRequest{term=1, version=139, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 139\nstate uuid: 08RLR1lcT6qYchgSqOw28g\nfrom_diff: false\nmeta data version: 137\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the metrics index template installed by x-pack\"}},\"synthetics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"synthetics\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the synthetics index template installed by x-pack\"}},\".alerts-ecs-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"tag\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"runtime\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"server\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"agent\":{\"properties\":{\"build\":{\"properties\":{\"original\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"log\":{\"properties\":{\"file\":{\"properties\":{\"path\":{\"type\":\"keyword\"}}},\"original\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"logger\":{\"type\":\"keyword\"},\"origin\":{\"properties\":{\"file\":{\"properties\":{\"line\":{\"type\":\"integer\"},\"name\":{\"type\":\"keyword\"}}},\"function\":{\"type\":\"keyword\"}}},\"syslog\":{\"type\":\"object\",\"properties\":{\"severity\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}},\"priority\":{\"type\":\"long\"},\"facility\":{\"properties\":{\"code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"}}}}}}},\"destination\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"rule\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"author\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"ruleset\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"source\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"code\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"stack_trace\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\"},\"type\":{\"type\":\"keyword\"}}},\"network\":{\"properties\":{\"transport\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"inner\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"packets\":{\"type\":\"long\"},\"community_id\":{\"type\":\"keyword\"},\"forwarded_ip\":{\"type\":\"ip\"},\"protocol\":{\"type\":\"keyword\"},\"application\":{\"type\":\"keyword\"},\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"bytes\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"iana_number\":{\"type\":\"keyword\"},\"direction\":{\"type\":\"keyword\"}}},\"cloud\":{\"properties\":{\"availability_zone\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"provider\":{\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"region\":{\"type\":\"keyword\"},\"account\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"observer\":{\"properties\":{\"product\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"ip\":{\"type\":\"ip\"},\"serial_number\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"mac\":{\"type\":\"keyword\"},\"egress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"ingress\":{\"type\":\"object\",\"properties\":{\"vlan\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"zone\":{\"type\":\"keyword\"},\"interface\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"alias\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"hostname\":{\"type\":\"keyword\"},\"vendor\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"trace\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"file\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"gid\":{\"type\":\"keyword\"},\"drive_letter\":{\"type\":\"keyword\"},\"accessed\":{\"type\":\"date\"},\"mtime\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"directory\":{\"type\":\"keyword\"},\"inode\":{\"type\":\"keyword\"},\"mode\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"uid\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"ctime\":{\"type\":\"date\"},\"group\":{\"type\":\"keyword\"},\"owner\":{\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"target_path\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"size\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"attributes\":{\"type\":\"keyword\"},\"device\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"host\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"hostname\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"mac\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"},\"uptime\":{\"type\":\"long\"}}},\"client\":{\"properties\":{\"nat\":{\"properties\":{\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"address\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"mac\":{\"type\":\"keyword\"},\"packets\":{\"type\":\"long\"},\"geo\":{\"properties\":{\"continent_name\":{\"type\":\"keyword\"},\"region_iso_code\":{\"type\":\"keyword\"},\"city_name\":{\"type\":\"keyword\"},\"country_iso_code\":{\"type\":\"keyword\"},\"country_name\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"bytes\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"user\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"event\":{\"properties\":{\"reason\":{\"type\":\"keyword\"},\"code\":{\"type\":\"keyword\"},\"timezone\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"agent_id_status\":{\"type\":\"keyword\"},\"duration\":{\"type\":\"long\"},\"reference\":{\"type\":\"keyword\"},\"ingested\":{\"type\":\"date\"},\"provider\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"id\":{\"type\":\"keyword\"},\"outcome\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"long\"},\"original\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"created\":{\"type\":\"date\"},\"kind\":{\"type\":\"keyword\"},\"module\":{\"type\":\"keyword\"},\"start\":{\"type\":\"date\"},\"url\":{\"type\":\"keyword\"},\"sequence\":{\"type\":\"long\"},\"risk_score_norm\":{\"type\":\"float\"},\"category\":{\"type\":\"keyword\"},\"dataset\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"user_agent\":{\"properties\":{\"original\":{\"type\":\"keyword\"},\"os\":{\"properties\":{\"kernel\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"family\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"platform\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"device\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"version\":{\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"registry\":{\"properties\":{\"hive\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"data\":{\"properties\":{\"strings\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"value\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"process\":{\"properties\":{\"parent\":{\"properties\":{\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"pgid\":{\"type\":\"long\"},\"start\":{\"type\":\"date\"},\"pid\":{\"type\":\"long\"},\"working_directory\":{\"type\":\"keyword\"},\"thread\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"long\"}}},\"entity_id\":{\"type\":\"keyword\"},\"title\":{\"type\":\"keyword\"},\"executable\":{\"type\":\"keyword\"},\"ppid\":{\"type\":\"long\"},\"uptime\":{\"type\":\"long\"},\"args\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"exit_code\":{\"type\":\"long\"},\"name\":{\"type\":\"keyword\"},\"args_count\":{\"type\":\"long\"},\"command_line\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"package\":{\"properties\":{\"installed\":{\"type\":\"date\"},\"build_version\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"reference\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"install_scope\":{\"type\":\"keyword\"},\"size\":{\"type\":\"long\"},\"checksum\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"dll\":{\"properties\":{\"path\":{\"type\":\"keyword\"},\"code_signature\":{\"properties\":{\"valid\":{\"type\":\"boolean\"},\"trusted\":{\"type\":\"boolean\"},\"subject_name\":{\"type\":\"keyword\"},\"exists\":{\"type\":\"boolean\"},\"status\":{\"type\":\"keyword\"}}},\"pe\":{\"properties\":{\"file_version\":{\"type\":\"keyword\"},\"product\":{\"type\":\"keyword\"},\"imphash\":{\"type\":\"keyword\"},\"description\":{\"type\":\"keyword\"},\"company\":{\"type\":\"keyword\"},\"original_file_name\":{\"type\":\"keyword\"},\"architecture\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"sha512\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}}}},\"dns\":{\"properties\":{\"op_code\":{\"type\":\"keyword\"},\"resolved_ip\":{\"type\":\"ip\"},\"response_code\":{\"type\":\"keyword\"},\"question\":{\"properties\":{\"registered_domain\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"}}},\"answers\":{\"type\":\"object\",\"properties\":{\"data\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"class\":{\"type\":\"keyword\"},\"ttl\":{\"type\":\"long\"}}},\"header_flags\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"vulnerability\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"score\":{\"properties\":{\"environmental\":{\"type\":\"float\"},\"version\":{\"type\":\"keyword\"},\"temporal\":{\"type\":\"float\"},\"base\":{\"type\":\"float\"}}},\"report_id\":{\"type\":\"keyword\"},\"scanner\":{\"properties\":{\"vendor\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"},\"classification\":{\"type\":\"keyword\"},\"enumeration\":{\"type\":\"keyword\"}}},\"message\":{\"type\":\"text\"},\"url\":{\"properties\":{\"extension\":{\"type\":\"keyword\"},\"original\":{\"type\":\"keyword\"},\"scheme\":{\"type\":\"keyword\"},\"top_level_domain\":{\"type\":\"keyword\"},\"query\":{\"type\":\"keyword\"},\"path\":{\"type\":\"keyword\"},\"fragment\":{\"type\":\"keyword\"},\"password\":{\"type\":\"keyword\"},\"registered_domain\":{\"type\":\"keyword\"},\"port\":{\"type\":\"long\"},\"domain\":{\"type\":\"keyword\"},\"subdomain\":{\"type\":\"keyword\"},\"full\":{\"type\":\"keyword\"},\"username\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"object\"},\"tags\":{\"type\":\"keyword\"},\"@timestamp\":{\"type\":\"date\"},\"service\":{\"properties\":{\"node\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"state\":{\"type\":\"keyword\"},\"ephemeral_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"}}},\"organization\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"http\":{\"properties\":{\"request\":{\"properties\":{\"referrer\":{\"type\":\"keyword\"},\"method\":{\"type\":\"keyword\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"response\":{\"properties\":{\"status_code\":{\"type\":\"long\"},\"mime_type\":{\"type\":\"keyword\"},\"bytes\":{\"type\":\"long\"},\"body\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"content\":{\"type\":\"keyword\"}}}}},\"version\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"cipher\":{\"type\":\"keyword\"},\"established\":{\"type\":\"boolean\"},\"server\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"ja3s\":{\"type\":\"keyword\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"curve\":{\"type\":\"keyword\"},\"client\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"server_name\":{\"type\":\"keyword\"},\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"public_key_exponent\":{\"type\":\"long\"},\"not_before\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}},\"public_key_algorithm\":{\"type\":\"keyword\"},\"public_key_curve\":{\"type\":\"keyword\"},\"signature_algorithm\":{\"type\":\"keyword\"},\"public_key_size\":{\"type\":\"long\"},\"serial_number\":{\"type\":\"keyword\"},\"version_number\":{\"type\":\"keyword\"},\"alternative_names\":{\"type\":\"keyword\"},\"issuer\":{\"properties\":{\"country\":{\"type\":\"keyword\"},\"state_or_province\":{\"type\":\"keyword\"},\"organization\":{\"type\":\"keyword\"},\"distinguished_name\":{\"type\":\"keyword\"},\"locality\":{\"type\":\"keyword\"},\"common_name\":{\"type\":\"keyword\"},\"organizational_unit\":{\"type\":\"keyword\"}}}}},\"not_before\":{\"type\":\"date\"},\"subject\":{\"type\":\"keyword\"},\"supported_ciphers\":{\"type\":\"keyword\"},\"certificate\":{\"type\":\"keyword\"},\"ja3\":{\"type\":\"keyword\"},\"certificate_chain\":{\"type\":\"keyword\"},\"hash\":{\"properties\":{\"sha1\":{\"type\":\"keyword\"},\"sha256\":{\"type\":\"keyword\"},\"md5\":{\"type\":\"keyword\"}}},\"issuer\":{\"type\":\"keyword\"}}},\"next_protocol\":{\"type\":\"keyword\"},\"resumed\":{\"type\":\"boolean\"},\"version\":{\"type\":\"keyword\"},\"version_protocol\":{\"type\":\"keyword\"}}},\"threat\":{\"properties\":{\"framework\":{\"type\":\"keyword\"},\"technique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"subtechnique\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"}}},\"tactic\":{\"properties\":{\"reference\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"changes\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"target\":{\"properties\":{\"full_name\":{\"type\":\"keyword\"},\"domain\":{\"type\":\"keyword\"},\"roles\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"email\":{\"type\":\"keyword\"},\"hash\":{\"type\":\"keyword\"},\"group\":{\"properties\":{\"domain\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}}}}}},\"transaction\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"span\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.uptime.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"observer\":{\"properties\":{\"geo\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}}}},\"agent\":{\"properties\":{\"name\":{\"type\":\"keyword\"}}},\"anomaly\":{\"properties\":{\"bucket_span\":{\"properties\":{\"minutes\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"}}},\"monitor\":{\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"tls\":{\"properties\":{\"server\":{\"properties\":{\"x509\":{\"properties\":{\"not_after\":{\"type\":\"date\"},\"subject\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}},\"not_before\":{\"type\":\"date\"},\"issuer\":{\"properties\":{\"common_name\":{\"type\":\"keyword\"}}}}},\"hash\":{\"properties\":{\"sha256\":{\"type\":\"keyword\"}}}}}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"url\":{\"properties\":{\"full\":{\"type\":\"keyword\"}}}}}}},\".alerts-observability.apm.alerts-mappings\":{\"template\":{\"settings\":{},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"service\":{\"properties\":{\"environment\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"}}},\"processor\":{\"properties\":{\"event\":{\"type\":\"keyword\"}}},\"transaction\":{\"properties\":{\"type\":{\"type\":\"keyword\"}}}}}}},\"logs-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-system.auth@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.cpu@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-system.filesystem@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.fsstat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\".deprecation-indexing-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\".deprecation-indexing-ilm-policy\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for Stack deprecation logs index template installed by x-pack\"}},\"logs-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.auditbeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the logs index template installed by x-pack\"}},\"logs-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-technical-mappings\":{\"template\":{\"settings\":{\"index\":{\"number_of_shards\":\"1\"}},\"mappings\":{\"dynamic\":\"strict\",\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"kind\":{\"type\":\"keyword\"},\"action\":{\"type\":\"keyword\"}}},\"kibana\":{\"properties\":{\"alert\":{\"properties\":{\"severity\":{\"type\":\"keyword\"},\"workflow_status\":{\"type\":\"keyword\"},\"reason\":{\"type\":\"keyword\"},\"instance\":{\"properties\":{\"id\":{\"type\":\"keyword\"}}},\"start\":{\"type\":\"date\"},\"rule\":{\"properties\":{\"note\":{\"type\":\"keyword\"},\"references\":{\"type\":\"keyword\"},\"severity_mapping\":{\"type\":\"object\",\"properties\":{\"severity\":{\"type\":\"keyword\"},\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"created_at\":{\"type\":\"date\"},\"description\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"uuid\":{\"type\":\"keyword\"},\"enabled\":{\"type\":\"keyword\"},\"rule_name_override\":{\"type\":\"keyword\"},\"updated_at\":{\"type\":\"date\"},\"from\":{\"type\":\"date\"},\"consumer\":{\"type\":\"keyword\"},\"severity\":{\"type\":\"keyword\"},\"risk_score\":{\"type\":\"float\"},\"risk_score_mapping\":{\"type\":\"object\",\"properties\":{\"field\":{\"type\":\"keyword\"},\"value\":{\"type\":\"keyword\"},\"operator\":{\"type\":\"keyword\"}}},\"author\":{\"type\":\"keyword\"},\"created_by\":{\"type\":\"keyword\"},\"version\":{\"type\":\"keyword\"},\"rule_type_id\":{\"type\":\"keyword\"},\"tags\":{\"type\":\"keyword\"},\"rule_id\":{\"type\":\"keyword\"},\"license\":{\"type\":\"keyword\"},\"name\":{\"type\":\"keyword\"},\"updated_by\":{\"type\":\"keyword\"},\"producer\":{\"type\":\"keyword\"},\"interval\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"},\"category\":{\"type\":\"keyword\"}}},\"uuid\":{\"type\":\"keyword\"},\"workflow_reason\":{\"type\":\"keyword\"},\"duration\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"evaluation\":{\"properties\":{\"threshold\":{\"scaling_factor\":100,\"type\":\"scaled_float\"},\"value\":{\"scaling_factor\":100,\"type\":\"scaled_float\"}}},\"action_group\":{\"type\":\"keyword\"},\"system_status\":{\"type\":\"keyword\"},\"end\":{\"type\":\"date\"},\"workflow_user\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"space_ids\":{\"type\":\"keyword\"},\"version\":{\"type\":\"version\"}}},\"tags\":{\"type\":\"keyword\"}}}}},\"metrics-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"data-streams-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"match_ip\":{\"mapping\":{\"type\":\"ip\"},\"match_mapping_type\":\"string\",\"match\":\"ip\"}},{\"match_message\":{\"mapping\":{\"type\":\"match_only_text\"},\"match_mapping_type\":\"string\",\"match\":\"message\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"type\":\"object\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"general mapping conventions for data streams\"}},\"logs-elastic_agent.fleet_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.filebeat@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.logs.alerts-mappings\":{\"template\":{\"settings\":{}}},\"metrics-elastic_agent.elastic_agent@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"synthetics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"synthetics\"},\"codec\":\"best_compression\"}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the synthetics index template installed by x-pack\"}},\"logs-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"}}}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for the logs index template installed by x-pack\"}},\"metrics-elastic_agent.auditbeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".deprecation-indexing-mappings\":{\"template\":{\"mappings\":{\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"@timestamp\":{\"type\":\"date\"},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"ip\":{\"type\":\"ip\"}}},\"message\":{\"type\":\"text\"}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default mappings for Stack deprecation logs index template installed by x-pack\"}},\"metrics-elastic_agent.apm_server@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"logs-elastic_agent@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".alerts-observability.metrics.alerts-mappings\":{\"template\":{\"settings\":{}}},\"logs-elastic_agent.endpoint_security@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.load@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-settings\":{\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"query\":{\"default_field\":[\"message\"]}}}},\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default settings for the metrics index template installed by x-pack\"}},\"metrics-elastic_agent.fleet_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.diskio@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"logs-elastic_agent.apm_server@mappings\":{\"template\":{\"mappings\":{\"dynamic\":false}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\".fleet_component_template-1\":{\"template\":{\"settings\":{\"index\":{\"final_pipeline\":\".fleet_final_pipeline-1\"}},\"mappings\":{\"properties\":{\"event\":{\"properties\":{\"agent_id_status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ingested\":{\"format\":\"strict_date_time_no_millis||strict_date_optional_time||epoch_millis\",\"type\":\"date\"}}}}}},\"_meta\":{}},\"logs-elastic_agent.filebeat@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-elastic_agent.endpoint_security@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"elastic_agent\"}}},\"metrics-system.core@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}}}}   index_template: {\"index_template\":{\"metrics-system.fsstat\":{\"index_patterns\":[\"metrics-system.fsstat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"fsstat\":{\"properties\":{\"total_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"total_size\":{\"properties\":{\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.fsstat\"}}}}}},\"composed_of\":[\"metrics-system.fsstat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.endpoint_security\":{\"index_patterns\":[\"metrics-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.endpoint_security@mappings\",\"metrics-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.apm_server\":{\"index_patterns\":[\"metrics-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.apm_server@mappings\",\"metrics-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.elastic_agent\":{\"index_patterns\":[\"metrics-elastic_agent.elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"beat.stats.libbeat.output.type\",\"beat.stats.beat.name\",\"beat.stats.beat.host\",\"beat.stats.beat.type\",\"beat.stats.beat.uuid\",\"beat.stats.beat.version\",\"beat.stats.info.ephemeral_id\",\"beat.stats.cgroup.cpu.id\",\"beat.stats.cgroup.cpuacct.id\",\"beat.stats.cgroup.memory.id\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"handles\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"type\":\"long\"},\"soft\":{\"type\":\"long\"}}},\"open\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"load\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"},\"norm\":{\"properties\":{\"1\":{\"type\":\"double\"},\"15\":{\"type\":\"double\"},\"5\":{\"type\":\"double\"}}}}},\"cpu\":{\"properties\":{\"cores\":{\"type\":\"long\"}}}}},\"beat\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"host\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}},\"value\":{\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}}}},\"runtime\":{\"properties\":{\"goroutines\":{\"type\":\"long\"}}},\"memstats\":{\"properties\":{\"memory\":{\"properties\":{\"total\":{\"type\":\"long\"},\"alloc\":{\"type\":\"long\"}}},\"rss\":{\"type\":\"long\"},\"gc_next\":{\"type\":\"long\"}}},\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}},\"pipeline\":{\"properties\":{\"clients\":{\"type\":\"long\"},\"queue\":{\"properties\":{\"acked\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"total\":{\"type\":\"long\"},\"filtered\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"published\":{\"type\":\"long\"},\"retry\":{\"type\":\"long\"}}}}},\"config\":{\"properties\":{\"running\":{\"type\":\"short\"},\"stops\":{\"type\":\"short\"},\"starts\":{\"type\":\"short\"}}}}},\"cgroup\":{\"properties\":{\"memory\":{\"properties\":{\"mem\":{\"properties\":{\"usage\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"cfs\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"type\":\"long\"},\"periods\":{\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpuacct\":{\"properties\":{\"total\":{\"properties\":{\"ns\":{\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"info\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"uptime\":{\"properties\":{\"ms\":{\"type\":\"long\"}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.elastic_agent@mappings\",\"metrics-elastic_agent.elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.fleet_server\":{\"index_patterns\":[\"metrics-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.fleet_server@mappings\",\"metrics-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.fleet_server\":{\"index_patterns\":[\"logs-elastic_agent.fleet_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.fleet_server@mappings\",\"logs-elastic_agent.fleet_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.core\":{\"index_patterns\":[\"metrics-system.core-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.core.id\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"core\":{\"properties\":{\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.core\"}}}}}},\"composed_of\":[\"metrics-system.core@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".slm-history\":{\"index_patterns\":[\".slm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"slm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"snapshot_name\":{\"type\":\"keyword\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"configuration\":{\"dynamic\":false,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"include_global_state\":{\"type\":\"boolean\"},\"partial\":{\"type\":\"boolean\"}}},\"error_details\":{\"index\":false,\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"repository\":{\"type\":\"keyword\"},\"operation\":{\"type\":\"keyword\"},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for SLM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-system.application\":{\"index_patterns\":[\"logs-system.application-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"event.code\",\"event.original\",\"error.message\",\"winlog.api\",\"winlog.activity_id\",\"winlog.computer_name\",\"winlog.event_data.AuthenticationPackageName\",\"winlog.event_data.Binary\",\"winlog.event_data.BitlockerUserInputTime\",\"winlog.event_data.BootMode\",\"winlog.event_data.BootType\",\"winlog.event_data.BuildVersion\",\"winlog.event_data.Company\",\"winlog.event_data.CorruptionActionState\",\"winlog.event_data.CreationUtcTime\",\"winlog.event_data.Description\",\"winlog.event_data.Detail\",\"winlog.event_data.DeviceName\",\"winlog.event_data.DeviceNameLength\",\"winlog.event_data.DeviceTime\",\"winlog.event_data.DeviceVersionMajor\",\"winlog.event_data.DeviceVersionMinor\",\"winlog.event_data.DriveName\",\"winlog.event_data.DriverName\",\"winlog.event_data.DriverNameLength\",\"winlog.event_data.DwordVal\",\"winlog.event_data.EntryCount\",\"winlog.event_data.ExtraInfo\",\"winlog.event_data.FailureName\",\"winlog.event_data.FailureNameLength\",\"winlog.event_data.FileVersion\",\"winlog.event_data.FinalStatus\",\"winlog.event_data.Group\",\"winlog.event_data.IdleImplementation\",\"winlog.event_data.IdleStateCount\",\"winlog.event_data.ImpersonationLevel\",\"winlog.event_data.IntegrityLevel\",\"winlog.event_data.IpAddress\",\"winlog.event_data.IpPort\",\"winlog.event_data.KeyLength\",\"winlog.event_data.LastBootGood\",\"winlog.event_data.LastShutdownGood\",\"winlog.event_data.LmPackageName\",\"winlog.event_data.LogonGuid\",\"winlog.event_data.LogonId\",\"winlog.event_data.LogonProcessName\",\"winlog.event_data.LogonType\",\"winlog.event_data.MajorVersion\",\"winlog.event_data.MaximumPerformancePercent\",\"winlog.event_data.MemberName\",\"winlog.event_data.MemberSid\",\"winlog.event_data.MinimumPerformancePercent\",\"winlog.event_data.MinimumThrottlePercent\",\"winlog.event_data.MinorVersion\",\"winlog.event_data.NewProcessId\",\"winlog.event_data.NewProcessName\",\"winlog.event_data.NewSchemeGuid\",\"winlog.event_data.NewTime\",\"winlog.event_data.NominalFrequency\",\"winlog.event_data.Number\",\"winlog.event_data.OldSchemeGuid\",\"winlog.event_data.OldTime\",\"winlog.event_data.OriginalFileName\",\"winlog.event_data.Path\",\"winlog.event_data.PerformanceImplementation\",\"winlog.event_data.PreviousCreationUtcTime\",\"winlog.event_data.PreviousTime\",\"winlog.event_data.PrivilegeList\",\"winlog.event_data.ProcessId\",\"winlog.event_data.ProcessName\",\"winlog.event_data.ProcessPath\",\"winlog.event_data.ProcessPid\",\"winlog.event_data.Product\",\"winlog.event_data.PuaCount\",\"winlog.event_data.PuaPolicyId\",\"winlog.event_data.QfeVersion\",\"winlog.event_data.Reason\",\"winlog.event_data.SchemaVersion\",\"winlog.event_data.ScriptBlockText\",\"winlog.event_data.ServiceName\",\"winlog.event_data.ServiceVersion\",\"winlog.event_data.ShutdownActionType\",\"winlog.event_data.ShutdownEventCode\",\"winlog.event_data.ShutdownReason\",\"winlog.event_data.Signature\",\"winlog.event_data.SignatureStatus\",\"winlog.event_data.Signed\",\"winlog.event_data.StartTime\",\"winlog.event_data.State\",\"winlog.event_data.Status\",\"winlog.event_data.StopTime\",\"winlog.event_data.SubjectDomainName\",\"winlog.event_data.SubjectLogonId\",\"winlog.event_data.SubjectUserName\",\"winlog.event_data.SubjectUserSid\",\"winlog.event_data.TSId\",\"winlog.event_data.TargetDomainName\",\"winlog.event_data.TargetInfo\",\"winlog.event_data.TargetLogonGuid\",\"winlog.event_data.TargetLogonId\",\"winlog.event_data.TargetServerName\",\"winlog.event_data.TargetUserName\",\"winlog.event_data.TargetUserSid\",\"winlog.event_data.TerminalSessionId\",\"winlog.event_data.TokenElevationType\",\"winlog.event_data.TransmittedServices\",\"winlog.event_data.UserSid\",\"winlog.event_data.Version\",\"winlog.event_data.Workstation\",\"winlog.event_data.param1\",\"winlog.event_data.param2\",\"winlog.event_data.param3\",\"winlog.event_data.param4\",\"winlog.event_data.param5\",\"winlog.event_data.param6\",\"winlog.event_data.param7\",\"winlog.event_data.param8\",\"winlog.event_id\",\"winlog.keywords\",\"winlog.channel\",\"winlog.record_id\",\"winlog.related_activity_id\",\"winlog.opcode\",\"winlog.provider_guid\",\"winlog.provider_name\",\"winlog.task\",\"winlog.user.identifier\",\"winlog.user.name\",\"winlog.user.domain\",\"winlog.user.type\"]},\"default_pipeline\":\"logs-system.application-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"winlog\":{\"properties\":{\"related_activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"computer_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"process\":{\"properties\":{\"pid\":{\"type\":\"long\"},\"thread\":{\"properties\":{\"id\":{\"type\":\"long\"}}}}},\"keywords\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"channel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_data\":{\"properties\":{\"SignatureStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OriginalFileName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootMode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Product\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FileVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StopTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Status\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CorruptionActionState\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"KeyLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousCreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PerformanceImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Group\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Description\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownActionType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DwordVal\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMajor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ScriptBlockText\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TransmittedServices\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MaximumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FinalStatus\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleStateCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MajorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SchemaVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TokenElevationType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinorVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IdleImplementation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessPath\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"QfeVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceVersionMinor\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpAddress\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Company\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaPolicyId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IntegrityLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastShutdownGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"IpPort\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LmPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"UserSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LastBootGood\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PuaCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signed\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"StartTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownEventCode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ServiceName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PreviousTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"State\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BootType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Binary\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ImpersonationLevel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Detail\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TerminalSessionId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MemberSid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriverName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DeviceNameLength\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"OldSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"CreationUtcTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Reason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ShutdownReason\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetServerName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BuildVersion\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumPerformancePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonProcessName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TSId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetDomainName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"PrivilegeList\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param7\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param8\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param5\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param6\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"DriveName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"LogonType\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ExtraInfo\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param3\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param4\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param1\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"param2\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"TargetLogonId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Workstation\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"SubjectUserName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"FailureName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NewSchemeGuid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"Signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"MinimumThrottlePercent\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ProcessId\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"EntryCount\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"BitlockerUserInputTime\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"AuthenticationPackageName\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"NominalFrequency\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user_data\":{\"type\":\"object\"},\"opcode\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"type\":\"long\"},\"record_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"task\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_guid\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"activity_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"api\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"properties\":{\"identifier\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"original\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.application\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}}}}},\"composed_of\":[\"logs-system.application@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-elastic_agent.filebeat\":{\"index_patterns\":[\"metrics-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.filebeat@mappings\",\"metrics-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.auditbeat\":{\"index_patterns\":[\"logs-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.auditbeat@mappings\",\"logs-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs\":{\"index_patterns\":[\"logs-*-*\"],\"composed_of\":[\"logs-mappings\",\"data-streams-mappings\",\"logs-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default logs template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.cpu\":{\"index_patterns\":[\"metrics-system.cpu-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"cores\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"system\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"softirq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"idle\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"steal\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"irq\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"iowait\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"user\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}},\"nice\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"norm\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"}}}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpu\":{\"properties\":{\"pct\":{\"scaling_factor\":1000,\"type\":\"scaled_float\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.cpu\"}}}}}},\"composed_of\":[\"metrics-system.cpu@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".watch-history-14\":{\"index_patterns\":[\".watcher-history-14*\"],\"template\":{\"settings\":{\"index\":{\"format\":\"6\",\"lifecycle\":{\"name\":\"watch-history-ilm-policy\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"_meta\":{\"watcher-history-version\":\"14\"},\"dynamic\":false,\"dynamic_templates\":[{\"disabled_payload_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.payload\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_search_request_body_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*))\\\\.search\\\\.request\\\\.(body|template)\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_exception_fields\":{\"match_pattern\":\"regex\",\"path_match\":\"result\\\\.(input(\\\\..+)*|(transform(\\\\..+)*)|(actions\\\\.transform(\\\\..+)*)|actions)\\\\.error\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}},{\"disabled_jira_custom_fields\":{\"path_match\":\"result.actions.jira.fields.customfield_*\",\"mapping\":{\"type\":\"object\",\"enabled\":false}}}],\"properties\":{\"exception\":{\"type\":\"object\",\"enabled\":false},\"metadata\":{\"dynamic\":true,\"type\":\"object\"},\"trigger_event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}},\"triggered_time\":{\"type\":\"date\"},\"type\":{\"type\":\"keyword\"},\"manual\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"schedule\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"scheduled_time\":{\"type\":\"date\"}}}}}}},\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"input\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"},\"search_type\":{\"type\":\"keyword\"}}}}},\"payload\":{\"type\":\"object\",\"enabled\":false},\"http\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"},\"status\":{\"type\":\"keyword\"}}},\"condition\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"compare\":{\"type\":\"object\",\"enabled\":false},\"array_compare\":{\"type\":\"object\",\"enabled\":false},\"type\":{\"type\":\"keyword\"},\"met\":{\"type\":\"boolean\"},\"script\":{\"type\":\"object\",\"enabled\":false},\"status\":{\"type\":\"keyword\"}}},\"transform\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"search\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"indices\":{\"type\":\"keyword\"},\"types\":{\"type\":\"keyword\"}}}}},\"type\":{\"type\":\"keyword\"}}},\"execution_duration\":{\"type\":\"long\"},\"actions\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"keyword\"},\"foreach\":{\"type\":\"object\",\"enabled\":false},\"webhook\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"request\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"path\":{\"type\":\"keyword\"},\"host\":{\"type\":\"keyword\"}}}}},\"number_of_actions_executed\":{\"type\":\"integer\"},\"slack\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_messages\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"to\":{\"type\":\"keyword\"},\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"attachments\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"color\":{\"type\":\"keyword\"},\"fields\":{\"properties\":{\"value\":{\"type\":\"text\"}}}}},\"icon\":{\"type\":\"keyword\"},\"from\":{\"type\":\"text\"},\"text\":{\"type\":\"text\"}}},\"status\":{\"type\":\"keyword\"}}},\"account\":{\"type\":\"keyword\"}}},\"index\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"response\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}}}},\"pagerduty\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"sent_event\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"event\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"client_url\":{\"type\":\"keyword\"},\"context\":{\"include_in_parent\":true,\"dynamic\":true,\"type\":\"nested\",\"properties\":{\"src\":{\"type\":\"keyword\"},\"alt\":{\"type\":\"text\"},\"href\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"}}},\"client\":{\"type\":\"text\"},\"description\":{\"type\":\"text\"},\"attach_payload\":{\"type\":\"boolean\"},\"incident_key\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"account\":{\"type\":\"keyword\"}}}}},\"account\":{\"type\":\"keyword\"}}},\"id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"email\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"message\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"cc\":{\"type\":\"keyword\"},\"bcc\":{\"type\":\"keyword\"},\"reply_to\":{\"type\":\"keyword\"},\"from\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"to\":{\"type\":\"keyword\"}}}}},\"status\":{\"type\":\"keyword\"},\"jira\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"result\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"self\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"reason\":{\"type\":\"text\"},\"request\":{\"type\":\"object\",\"enabled\":false},\"response\":{\"type\":\"object\",\"enabled\":false},\"fields\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"text\"},\"issuetype\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"keyword\"},\"id\":{\"type\":\"keyword\"}}},\"description\":{\"type\":\"text\"},\"project\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"id\":{\"type\":\"keyword\"},\"key\":{\"type\":\"keyword\"}}},\"labels\":{\"type\":\"text\"}}},\"account\":{\"type\":\"keyword\"}}}}},\"execution_time\":{\"type\":\"date\"}}},\"node\":{\"type\":\"keyword\"},\"input\":{\"type\":\"object\",\"enabled\":false},\"condition\":{\"type\":\"object\",\"enabled\":false},\"watch_id\":{\"type\":\"keyword\"},\"messages\":{\"type\":\"text\"},\"vars\":{\"type\":\"object\",\"enabled\":false},\"state\":{\"type\":\"keyword\"},\"user\":{\"type\":\"text\"},\"status\":{\"dynamic\":true,\"type\":\"object\",\"enabled\":false}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":14,\"_meta\":{\"managed\":true,\"description\":\"index template for watcher history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"logs-elastic_agent.apm_server\":{\"index_patterns\":[\"logs-elastic_agent.apm_server-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.apm_server@mappings\",\"logs-elastic_agent.apm_server@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"synthetics\":{\"index_patterns\":[\"synthetics-*-*\"],\"composed_of\":[\"synthetics-mappings\",\"data-streams-mappings\",\"synthetics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default synthetics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\"metrics-system.diskio\":{\"index_patterns\":[\"metrics-system.diskio-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"system.diskio.name\",\"system.diskio.serial_number\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"diskio\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"iostat\":{\"properties\":{\"request\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"service_time\":{\"meta\":{\"unit\":\"ms\",\"metric_type\":\"gauge\"},\"type\":\"float\"},\"read\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"busy\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"write\":{\"properties\":{\"request\":{\"properties\":{\"merges_per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}},\"await\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"},\"per_sec\":{\"properties\":{\"bytes\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"queue\":{\"properties\":{\"avg_size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"float\"}}}}},\"io\":{\"properties\":{\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"serial_number\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"write\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"count\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"disk\":{\"properties\":{\"read\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}},\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"}}}}},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.diskio\"}}}}}},\"composed_of\":[\"metrics-system.diskio@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-system.auth\":{\"index_patterns\":[\"logs-system.auth-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.os.full\",\"host.type\",\"event.action\",\"event.category\",\"event.code\",\"event.kind\",\"event.outcome\",\"event.provider\",\"event.type\",\"ecs.version\",\"error.message\",\"group.id\",\"group.name\",\"message\",\"process.name\",\"related.hosts\",\"related.user\",\"source.as.organization.name\",\"source.geo.city_name\",\"source.geo.continent_name\",\"source.geo.country_iso_code\",\"source.geo.country_name\",\"source.geo.region_iso_code\",\"source.geo.region_name\",\"user.effective.name\",\"user.id\",\"user.name\",\"system.auth.ssh.method\",\"system.auth.ssh.signature\",\"system.auth.ssh.event\",\"system.auth.sudo.error\",\"system.auth.sudo.tty\",\"system.auth.sudo.pwd\",\"system.auth.sudo.user\",\"system.auth.sudo.command\",\"system.auth.useradd.home\",\"system.auth.useradd.shell\",\"version\"]},\"default_pipeline\":\"logs-system.auth-1.3.0\",\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"process\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pid\":{\"type\":\"long\"}}},\"source\":{\"properties\":{\"geo\":{\"properties\":{\"continent_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"region_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"city_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_iso_code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"country_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"location\":{\"type\":\"geo_point\"},\"region_name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"as\":{\"properties\":{\"number\":{\"type\":\"long\"},\"organization\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"port\":{\"type\":\"long\"},\"ip\":{\"type\":\"ip\"}}},\"error\":{\"properties\":{\"message\":{\"type\":\"text\"}}},\"message\":{\"type\":\"text\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"auth\":{\"properties\":{\"ssh\":{\"properties\":{\"geoip\":{\"properties\":{}},\"method\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dropped_ip\":{\"type\":\"ip\"},\"signature\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"event\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"sudo\":{\"properties\":{\"tty\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"error\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"pwd\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"command\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"useradd\":{\"properties\":{\"shell\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"home\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"groupadd\":{\"properties\":{}}}}}},\"ecs\":{\"properties\":{\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"related\":{\"properties\":{\"hosts\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"user\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\",\"value\":\"logs\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"full\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"sequence\":{\"type\":\"long\"},\"ingested\":{\"type\":\"date\"},\"code\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"created\":{\"type\":\"date\"},\"kind\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"action\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"category\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.auth\"},\"outcome\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"user\":{\"properties\":{\"effective\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"group\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}}},\"composed_of\":[\"logs-system.auth@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.filebeat\":{\"index_patterns\":[\"logs-elastic_agent.filebeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.filebeat@mappings\",\"logs-elastic_agent.filebeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"logs-elastic_agent.endpoint_security\":{\"index_patterns\":[\"logs-elastic_agent.endpoint_security-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent.endpoint_security@mappings\",\"logs-elastic_agent.endpoint_security@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-state\":{\"index_patterns\":[\".ml-state*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-state-write\"},\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8000099\"},\"enabled\":false},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML state indices\"}},\"ilm-history\":{\"index_patterns\":[\"ilm-history-5*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ilm-history-ilm-policy\"},\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\",\"number_of_replicas\":\"0\"}},\"mappings\":{\"dynamic\":false,\"properties\":{\"index_age\":{\"type\":\"long\"},\"@timestamp\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"error_details\":{\"type\":\"text\"},\"success\":{\"type\":\"boolean\"},\"index\":{\"type\":\"keyword\"},\"state\":{\"dynamic\":true,\"type\":\"object\",\"properties\":{\"phase\":{\"type\":\"keyword\"},\"failed_step\":{\"type\":\"keyword\"},\"phase_definition\":{\"type\":\"text\"},\"action_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"phase_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_info\":{\"type\":\"text\"},\"action\":{\"type\":\"keyword\"},\"step\":{\"type\":\"keyword\"},\"is_auto-retryable_error\":{\"type\":\"keyword\"},\"creation_date\":{\"format\":\"epoch_millis\",\"type\":\"date\"},\"step_time\":{\"format\":\"epoch_millis\",\"type\":\"date\"}}},\"policy\":{\"type\":\"keyword\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":5,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\"metrics-elastic_agent.auditbeat\":{\"index_patterns\":[\"metrics-elastic_agent.auditbeat-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"beat.type\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\",\"system.process.cgroup.id\",\"system.process.cgroup.path\",\"system.process.cgroup.cpu.id\",\"system.process.cgroup.cpu.path\",\"system.process.cgroup.cpuacct.id\",\"system.process.cgroup.cpuacct.path\",\"system.process.cgroup.memory.id\",\"system.process.cgroup.memory.path\",\"system.process.cgroup.blkio.id\",\"system.process.cgroup.blkio.path\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"process\":{\"properties\":{\"memory\":{\"properties\":{\"size\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cpu\":{\"properties\":{\"total\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}},\"value\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"system\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}},\"user\":{\"properties\":{\"ticks\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"time\":{\"properties\":{\"ms\":{\"type\":\"date\"}}}}}}},\"cgroup\":{\"properties\":{\"blkio\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"ios\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"memory\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mem\":{\"properties\":{\"failures\":{\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"inactive_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"cache\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss_huge\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"mapped_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"swap\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"unevictable\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"active_anon\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"pages_in\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"hierarchical_memory_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"pages_out\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"inactive_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"hierarchical_memsw_limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"rss\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"major_page_faults\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"active_file\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"memsw\":{\"properties\":{\"failures\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem_tcp\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"kmem\":{\"properties\":{\"failures\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"usage\":{\"properties\":{\"max\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"limit\":{\"properties\":{\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cpu\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cfs\":{\"properties\":{\"shares\":{\"type\":\"long\"},\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"quota\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"rt\":{\"properties\":{\"period\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}},\"runtime\":{\"properties\":{\"us\":{\"meta\":{\"unit\":\"micros\"},\"type\":\"long\"}}}}},\"stats\":{\"properties\":{\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"},\"throttled\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"},\"periods\":{\"meta\":{\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"cpuacct\":{\"properties\":{\"path\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"stats\":{\"properties\":{\"system\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}},\"user\":{\"properties\":{\"ns\":{\"meta\":{\"unit\":\"nanos\",\"metric_type\":\"counter\"},\"type\":\"long\"}}}}},\"percpu\":{\"type\":\"object\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"fd\":{\"properties\":{\"limit\":{\"properties\":{\"hard\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"soft\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"open\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"beat\":{\"properties\":{\"stats\":{\"properties\":{\"libbeat\":{\"properties\":{\"output\":{\"properties\":{\"write\":{\"properties\":{\"bytes\":{\"type\":\"long\"},\"errors\":{\"type\":\"long\"}}},\"events\":{\"properties\":{\"batches\":{\"type\":\"long\"},\"duplicates\":{\"type\":\"long\"},\"total\":{\"type\":\"long\"},\"dropped\":{\"type\":\"long\"},\"toomany\":{\"type\":\"long\"},\"active\":{\"type\":\"long\"},\"failed\":{\"type\":\"long\"},\"acked\":{\"type\":\"long\"}}}}}}}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}}}}},\"composed_of\":[\"metrics-elastic_agent.auditbeat@mappings\",\"metrics-elastic_agent.auditbeat@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\"metrics-system.filesystem\":{\"index_patterns\":[\"metrics-system.filesystem-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"metrics\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"system.filesystem.device_name\",\"system.filesystem.type\",\"system.filesystem.mount_point\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"system\":{\"properties\":{\"filesystem\":{\"properties\":{\"device_name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"total\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"mount_point\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free_files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"available\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"},\"files\":{\"meta\":{\"metric_type\":\"gauge\"},\"type\":\"long\"},\"used\":{\"properties\":{\"pct\":{\"meta\":{\"unit\":\"percent\",\"metric_type\":\"gauge\"},\"scaling_factor\":1000,\"type\":\"scaled_float\"},\"bytes\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"free\":{\"meta\":{\"unit\":\"byte\",\"metric_type\":\"gauge\"},\"type\":\"long\"}}}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"event\":{\"properties\":{\"module\":{\"type\":\"constant_keyword\",\"value\":\"system\"},\"dataset\":{\"type\":\"constant_keyword\",\"value\":\"system.filesystem\"}}}}}},\"composed_of\":[\"metrics-system.filesystem@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"system\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}},\".ml-anomalies-\":{\"index_patterns\":[\".ml-anomalies-*\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"translog\":{\"durability\":\"async\"},\"auto_expand_replicas\":\"0-1\",\"query\":{\"default_field\":\"all_field_values\"}}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic_templates\":[{\"strings_as_keywords\":{\"mapping\":{\"type\":\"keyword\"},\"match\":\"*\"}}],\"properties\":{\"search_count\":{\"type\":\"long\"},\"bucket_count\":{\"type\":\"long\"},\"terms\":{\"type\":\"text\"},\"record_score\":{\"type\":\"double\"},\"forecast_expiry_timestamp\":{\"type\":\"date\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"preferred_to_categories\":{\"type\":\"long\"},\"empty_bucket_count\":{\"type\":\"long\"},\"forecast_create_timestamp\":{\"type\":\"date\"},\"probability\":{\"type\":\"double\"},\"missing_field_count\":{\"type\":\"long\"},\"forecast_lower\":{\"type\":\"double\"},\"influencer_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"multi_bucket_impact\":{\"type\":\"double\"},\"forecast_progress\":{\"type\":\"double\"},\"max_matching_length\":{\"type\":\"long\"},\"latest_record_time_stamp\":{\"type\":\"date\"},\"regex\":{\"type\":\"keyword\"},\"examples\":{\"type\":\"text\"},\"snapshot_doc_count\":{\"type\":\"integer\"},\"average_bucket_processing_time_ms\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"initial_influencer_score\":{\"type\":\"double\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"model_lower\":{\"type\":\"double\"},\"total_over_field_count\":{\"type\":\"long\"},\"retain\":{\"type\":\"boolean\"},\"forecast_upper\":{\"type\":\"double\"},\"latest_sparse_bucket_timestamp\":{\"type\":\"date\"},\"model_median\":{\"type\":\"double\"},\"category_id\":{\"type\":\"long\"},\"causes\":{\"type\":\"nested\",\"properties\":{\"actual\":{\"type\":\"double\"},\"partition_field_name\":{\"type\":\"keyword\"},\"partition_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"field_name\":{\"type\":\"keyword\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"over_field_name\":{\"type\":\"keyword\"},\"correlated_by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"over_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"function_description\":{\"type\":\"keyword\"}}},\"all_field_values\":{\"analyzer\":\"whitespace\",\"type\":\"text\"},\"timestamp\":{\"type\":\"date\"},\"input_field_count\":{\"type\":\"long\"},\"model_bytes\":{\"type\":\"long\"},\"quantiles\":{\"type\":\"object\",\"enabled\":false},\"function_description\":{\"type\":\"keyword\"},\"min_version\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"exponential_average_bucket_processing_time_ms\":{\"type\":\"double\"},\"invalid_date_count\":{\"type\":\"long\"},\"snapshot_id\":{\"type\":\"keyword\"},\"model_size_stats\":{\"properties\":{\"model_bytes\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"peak_model_bytes\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"total_over_field_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"log_time\":{\"type\":\"date\"},\"timestamp\":{\"type\":\"date\"}}},\"total_search_time_ms\":{\"type\":\"double\"},\"latest_empty_bucket_timestamp\":{\"type\":\"date\"},\"anomaly_score\":{\"type\":\"double\"},\"over_field_name\":{\"type\":\"keyword\"},\"earliest_record_timestamp\":{\"type\":\"date\"},\"scheduled_events\":{\"type\":\"keyword\"},\"bucket_span\":{\"type\":\"long\"},\"maximum_bucket_processing_time_ms\":{\"type\":\"double\"},\"exponential_average_calculation_context\":{\"properties\":{\"incremental_metric_value_ms\":{\"type\":\"double\"},\"previous_exponential_average_ms\":{\"type\":\"double\"},\"latest_timestamp\":{\"type\":\"date\"}}},\"function\":{\"type\":\"keyword\"},\"influencers\":{\"type\":\"nested\",\"properties\":{\"influencer_field_name\":{\"type\":\"keyword\"},\"influencer_field_values\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"}}},\"input_record_count\":{\"type\":\"long\"},\"latest_result_time_stamp\":{\"type\":\"date\"},\"model_upper\":{\"type\":\"double\"},\"actual\":{\"type\":\"double\"},\"forecast_memory_bytes\":{\"type\":\"long\"},\"total_by_field_count\":{\"type\":\"long\"},\"geo_results\":{\"properties\":{\"actual_point\":{\"type\":\"geo_point\"},\"typical_point\":{\"type\":\"geo_point\"}}},\"detector_index\":{\"type\":\"integer\"},\"by_field_value\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_record_count\":{\"type\":\"long\"},\"total_partition_field_count\":{\"type\":\"long\"},\"mlcategory\":{\"type\":\"keyword\"},\"assignment_memory_basis\":{\"type\":\"keyword\"},\"forecast_end_timestamp\":{\"type\":\"date\"},\"forecast_id\":{\"type\":\"keyword\"},\"partition_field_name\":{\"type\":\"keyword\"},\"by_field_name\":{\"type\":\"keyword\"},\"event_count\":{\"type\":\"long\"},\"description\":{\"type\":\"text\"},\"is_interim\":{\"type\":\"boolean\"},\"bucket_allocation_failures_count\":{\"type\":\"long\"},\"memory_status\":{\"type\":\"keyword\"},\"model_feature\":{\"type\":\"keyword\"},\"num_matches\":{\"type\":\"long\"},\"influencer_score\":{\"type\":\"double\"},\"out_of_order_timestamp_count\":{\"type\":\"long\"},\"result_type\":{\"type\":\"keyword\"},\"last_data_time\":{\"type\":\"date\"},\"latest_record_timestamp\":{\"type\":\"date\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"forecast_messages\":{\"type\":\"keyword\"},\"sparse_bucket_count\":{\"type\":\"long\"},\"log_time\":{\"type\":\"date\"},\"field_name\":{\"type\":\"keyword\"},\"minimum_bucket_processing_time_ms\":{\"type\":\"double\"},\"bucket_influencers\":{\"type\":\"nested\",\"properties\":{\"anomaly_score\":{\"type\":\"double\"},\"initial_anomaly_score\":{\"type\":\"double\"},\"result_type\":{\"type\":\"keyword\"},\"raw_anomaly_score\":{\"type\":\"double\"},\"bucket_span\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"probability\":{\"type\":\"double\"},\"influencer_field_name\":{\"type\":\"keyword\"},\"is_interim\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}},\"processing_time_ms\":{\"type\":\"long\"},\"input_bytes\":{\"type\":\"long\"},\"initial_record_score\":{\"type\":\"double\"},\"job_id\":{\"copy_to\":[\"all_field_values\"],\"type\":\"keyword\"},\"processed_field_count\":{\"type\":\"long\"},\"forecast_status\":{\"type\":\"keyword\"},\"typical\":{\"type\":\"double\"},\"forecast_prediction\":{\"type\":\"double\"},\"forecast_start_timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML anomaly detection results indices\"}},\"metrics\":{\"index_patterns\":[\"metrics-*-*\"],\"composed_of\":[\"metrics-mappings\",\"data-streams-mappings\",\"metrics-settings\"],\"priority\":100,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default metrics template installed by x-pack\"},\"data_stream\":{\"hidden\":false},\"allow_auto_create\":true},\".ml-notifications-000002\":{\"index_patterns\":[\".ml-notifications-000002\"],\"template\":{\"settings\":{\"index\":{\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":\"false\",\"properties\":{\"job_type\":{\"type\":\"keyword\"},\"level\":{\"type\":\"keyword\"},\"job_id\":{\"type\":\"keyword\"},\"node_name\":{\"type\":\"keyword\"},\"message\":{\"type\":\"text\",\"fields\":{\"raw\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"cleared\":{\"type\":\"boolean\"},\"timestamp\":{\"type\":\"date\"}}}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML notifications indices\"}},\".deprecation-indexing-template\":{\"index_patterns\":[\".logs-deprecation.*\"],\"composed_of\":[\".deprecation-indexing-mappings\",\".deprecation-indexing-settings\"],\"priority\":1000,\"version\":1,\"_meta\":{\"managed\":true,\"description\":\"default template for Stack deprecation logs index template installed by x-pack\"},\"data_stream\":{\"hidden\":true},\"allow_auto_create\":true},\".ml-stats\":{\"index_patterns\":[\".ml-stats-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"ml-size-based-ilm-policy\",\"rollover_alias\":\".ml-stats-write\"},\"hidden\":\"true\",\"number_of_shards\":\"1\",\"auto_expand_replicas\":\"0-1\"}},\"mappings\":{\"_meta\":{\"version\":\"8.0.0\"},\"dynamic\":false,\"properties\":{\"skipped_docs_count\":{\"type\":\"long\"},\"validation_loss\":{\"properties\":{\"fold_values\":{\"properties\":{\"fold\":{\"type\":\"integer\"},\"values\":{\"type\":\"double\"}}},\"loss_type\":{\"type\":\"keyword\"}}},\"cache_miss_count\":{\"type\":\"long\"},\"timing_stats\":{\"properties\":{\"iteration_time\":{\"type\":\"long\"},\"elapsed_time\":{\"type\":\"long\"}}},\"failure_count\":{\"type\":\"long\"},\"model_id\":{\"type\":\"keyword\"},\"type\":{\"type\":\"keyword\"},\"training_docs_count\":{\"type\":\"long\"},\"inference_count\":{\"type\":\"long\"},\"job_id\":{\"type\":\"keyword\"},\"missing_all_fields_count\":{\"type\":\"long\"},\"peak_usage_bytes\":{\"type\":\"long\"},\"iteration\":{\"type\":\"integer\"},\"hyperparameters\":{\"properties\":{\"max_attempts_to_add_tree\":{\"type\":\"integer\"},\"downsample_factor\":{\"type\":\"double\"},\"eta_growth_rate_per_tree\":{\"type\":\"double\"},\"soft_tree_depth_tolerance\":{\"type\":\"double\"},\"max_trees\":{\"type\":\"integer\"},\"lambda\":{\"type\":\"double\"},\"max_optimization_rounds_per_hyperparameter\":{\"type\":\"integer\"},\"eta\":{\"type\":\"double\"},\"soft_tree_depth_limit\":{\"type\":\"double\"},\"alpha\":{\"type\":\"double\"},\"class_assignment_objective\":{\"type\":\"keyword\"},\"feature_bag_fraction\":{\"type\":\"double\"},\"num_splits_per_feature\":{\"type\":\"integer\"},\"gamma\":{\"type\":\"double\"},\"num_folds\":{\"type\":\"integer\"}}},\"parameters\":{\"properties\":{\"compute_feature_influence\":{\"type\":\"boolean\"},\"feature_influence_threshold\":{\"type\":\"double\"},\"outlier_fraction\":{\"type\":\"double\"},\"method\":{\"type\":\"keyword\"},\"standardization_enabled\":{\"type\":\"boolean\"},\"n_neighbors\":{\"type\":\"integer\"}}},\"test_docs_count\":{\"type\":\"long\"},\"node_id\":{\"type\":\"keyword\"},\"timestamp\":{\"type\":\"date\"}}},\"aliases\":{}},\"composed_of\":[],\"priority\":2147483647,\"version\":8000099,\"_meta\":{\"managed\":true,\"description\":\"index template for ML stats indices\"}},\"logs-elastic_agent\":{\"index_patterns\":[\"logs-elastic_agent-*\"],\"template\":{\"settings\":{\"index\":{\"lifecycle\":{\"name\":\"logs\"},\"codec\":\"best_compression\",\"mapping\":{\"total_fields\":{\"limit\":\"10000\"}},\"refresh_interval\":\"5s\",\"number_of_shards\":\"1\",\"query\":{\"default_field\":[\"cloud.account.id\",\"cloud.availability_zone\",\"cloud.instance.id\",\"cloud.instance.name\",\"cloud.machine.type\",\"cloud.provider\",\"cloud.region\",\"cloud.project.id\",\"cloud.image.id\",\"container.id\",\"container.image.name\",\"container.name\",\"host.architecture\",\"host.domain\",\"host.hostname\",\"host.id\",\"host.mac\",\"host.name\",\"host.os.family\",\"host.os.kernel\",\"host.os.name\",\"host.os.platform\",\"host.os.version\",\"host.os.build\",\"host.os.codename\",\"host.type\",\"log.level\",\"message\",\"elastic_agent.id\",\"elastic_agent.process\",\"elastic_agent.version\"]},\"number_of_routing_shards\":\"30\"}},\"mappings\":{\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"dynamic_templates\":[{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"date_detection\":false,\"properties\":{\"cloud\":{\"properties\":{\"availability_zone\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"image\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"instance\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"provider\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"machine\":{\"properties\":{\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"project\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"region\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"account\":{\"properties\":{\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"}}}}},\"container\":{\"properties\":{\"image\":{\"properties\":{\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"labels\":{\"type\":\"object\"}}},\"@timestamp\":{\"type\":\"date\"},\"log\":{\"properties\":{\"level\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"data_stream\":{\"properties\":{\"namespace\":{\"type\":\"constant_keyword\"},\"type\":{\"type\":\"constant_keyword\"},\"dataset\":{\"type\":\"constant_keyword\"}}},\"host\":{\"properties\":{\"hostname\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"os\":{\"properties\":{\"build\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"kernel\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"codename\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\",\"fields\":{\"text\":{\"type\":\"text\"}}},\"family\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"platform\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"domain\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"ip\":{\"type\":\"ip\"},\"containerized\":{\"type\":\"boolean\"},\"name\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"type\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"mac\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"architecture\":{\"ignore_above\":1024,\"type\":\"keyword\"}}},\"elastic_agent\":{\"properties\":{\"process\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"id\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"version\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"snapshot\":{\"type\":\"boolean\"}}},\"event\":{\"properties\":{\"dataset\":{\"type\":\"constant_keyword\"}}},\"message\":{\"type\":\"text\"}}}},\"composed_of\":[\"logs-elastic_agent@mappings\",\"logs-elastic_agent@custom\",\".fleet_component_template-1\"],\"priority\":200,\"_meta\":{\"package\":{\"name\":\"elastic_agent\"},\"managed_by\":\"ingest-manager\",\"managed\":true},\"data_stream\":{\"hidden\":false}}}}   index_lifecycle: {\n  \"policies\" : {\n    \".alerts-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"90d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200954168,\n      \"modified_date_string\" : \"2021-09-09T15:22:34.168Z\"\n    },\n    \".deprecation-indexing-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"10gb\",\n                \"max_age\" : \"14d\"\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949424,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.424Z\"\n    },\n    \".fleet-actions-results-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"300gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for fleet action results indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949534,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.534Z\"\n    },\n    \"ilm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the ILM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949200,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.200Z\"\n    },\n    \"kibana-event-log-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200961831,\n      \"modified_date_string\" : \"2021-09-09T15:22:41.831Z\"\n    },\n    \"kibana-reporting\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : { }\n          }\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwANa2liYW5hX3N5c3RlbQENa2liYW5hX3N5c3RlbQoBCV9yZXNlcnZlZAUBAAABABdKb3Nocy1NYWNCb29rLVByby5sb2NhbAhyZXNlcnZlZAhyZXNlcnZlZAAACgA=\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200962420,\n      \"modified_date_string\" : \"2021-09-09T15:22:42.420Z\"\n    },\n    \"logs\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the logs index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948842,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.842Z\"\n    },\n    \"metrics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the metrics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948710,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.710Z\"\n    },\n    \"ml-size-based-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for machine learning state and stats indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948404,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.404Z\"\n    },\n    \"slm-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          },\n          \"delete\" : {\n            \"min_age\" : \"90d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the SLM history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200949310,\n      \"modified_date_string\" : \"2021-09-09T15:22:29.310Z\"\n    },\n    \"synthetics\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"hot\" : {\n            \"min_age\" : \"0ms\",\n            \"actions\" : {\n              \"rollover\" : {\n                \"max_primary_shard_size\" : \"50gb\",\n                \"max_age\" : \"30d\"\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the synthetics index template installed by x-pack\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948613,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.613Z\"\n    },\n    \"watch-history-ilm-policy\" : {\n      \"policy\" : {\n        \"phases\" : {\n          \"delete\" : {\n            \"min_age\" : \"7d\",\n            \"actions\" : {\n              \"delete\" : {\n                \"delete_searchable_snapshot\" : true\n              }\n            }\n          }\n        },\n        \"_meta\" : {\n          \"managed\" : true,\n          \"description\" : \"default policy for the watcher history indices\"\n        }\n      },\n      \"headers\" : {\n        \"_xpack_security_authentication\" : \"46ToAwEGX3hwYWNrF0pvc2hzLU1hY0Jvb2stUHJvLmxvY2FsCF9fYXR0YWNoCF9fYXR0YWNoAAQKAA==\"\n      },\n      \"version\" : 1,\n      \"modified_date\" : 1631200948983,\n      \"modified_date_string\" : \"2021-09-09T15:22:28.983Z\"\n    }\n  },\n  \"operation_mode\" : \"RUNNING\"\n}   licenses: LicensesMetadata{license={\"uid\":\"29791a63-4252-4665-b3b4-471b34127370\",\"type\":\"trial\",\"issue_date_in_millis\":1631200949634,\"expiry_date_in_millis\":1633792949634,\"max_nodes\":1000,\"max_resource_units\":null,\"issued_to\":\"elasticsearch\",\"issuer\":\"elasticsearch\",\"signature\":\"////+wAAARAGwk4Qvi4cumKpuVRP6Z3fJQOCgT6hgh+4pmZAGsWVLuovYiQp7SK7Y09Cei5SkqVx5IlzR6SKg0UkFPPN/+F0PTFMKL5wC7BXn4CTS6kNo4Id6Yb5uwp6hgXZA2vieqcucvt7DORHXeNfQeCDWi7FqLO4oeLFFm9bxqmAfMsU8lzvWQtiN5PoUW7Z45s1ZYLr89XxMZTrFhE9H0Ag/nUgK11BjONEN6s8VuWy6ggHWANhRpCq9z59tbBoJE2WSNAqxPXhTMnK4VHHasxnOBiCzN2ooetfN0en7Jq0xkMklarhBT96hSH1EW3x7ou2/raQxLFLQ9kfTgs/m7zd3ftmylLIBKLth9edOIEQBhPZ4g==\",\"start_date_in_millis\":-1}, trialVersion=8.0.0}\nnodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\nrouting_table (version 16):\n-- index [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]\n----shard_id [.security-7][0]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n\n-- index [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]\n----shard_id [.apm-custom-link][0]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n\n-- index [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]\n----shard_id [.kibana_8.0.0_001][0]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n\n-- index [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]\n----shard_id [.kibana-event-log-8.0.0-000001][0]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n\n-- index [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]\n----shard_id [.kibana_task_manager_8.0.0_001][0]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n\n-- index [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]\n----shard_id [.kibana_security_session_1][0]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n\n-- index [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]\n----shard_id [.ds-ilm-history-5-2021.09.09-000001][0]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n\n-- index [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]\n----shard_id [.apm-agent-configuration][0]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n\nrouting_nodes:\n-----node_id[3RiJe2S3TCWXbzwX1pFRxQ][V]\n--------[.security-7][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=vBO-kiOPSAuujh0zkCtYag]\n--------[.apm-custom-link][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=aUHezjW2TMqx2JQxScrULA]\n--------[.kibana_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=TywZMX4NQEyZpp8vWhBIvA]\n--------[.kibana-event-log-8.0.0-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=XldW9oLRT_-w11BhvLSCjA]\n--------[.kibana_task_manager_8.0.0_001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=E1wQpniMQ6WDOv0ZR3XKxQ]\n--------[.kibana_security_session_1][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=YJWpkh1PQSeZ9aORp-Fh_g]\n--------[.ds-ilm-history-5-2021.09.09-000001][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=_VYEYp8UR4atApeH1WfnaA]\n--------[.apm-agent-configuration][0], node[3RiJe2S3TCWXbzwX1pFRxQ], [P], s[STARTED], a[id=c_j4tHVbQJW-onFL63E1pg]\n---- unassigned\ncustoms:\n   security_tokens: TokenMetadata{ everything is secret }}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.770Z", "log.level":"TRACE", "message":"handlePublishRequest: accepting publish request for version [139] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.770Z", "log.level":"TRACE", "message":"currentTerm [1] matches previous currentTerm, writing changes only", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.784Z", "log.level":"TRACE", "message":"updating global metadata doc", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.security-7/v7ZfC4IST72Oy8zGf7O_sg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"no action required for [[.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.786Z", "log.level":"TRACE", "message":"flushing", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService.MetadataIndexWriter","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch","tags":["[NIOFSDirectory@/Users/jdover/src/kibana/.es/8.0.0/data/_state lockFactory=org.apache.lucene.store.NativeFSLockFactory@5fb65af5]"]}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"DEBUG", "message":"writing cluster state took [202ms]; wrote global metadata [true] and metadata for [0] indices and skipped [8] unchanged indices", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.gateway.PersistedClusterStateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"TRACE", "message":"updating with preVoteResponse=PreVoteResponse{currentTerm=1, lastAcceptedTerm=1, lastAcceptedVersion=139}, leader={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#7]","log.logger":"org.elasticsearch.cluster.coordination.PreVoteCollector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"TRACE", "message":"handling join within publish response: Join{term=1, lastAcceptedTerm=0, lastAcceptedVersion=0, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, targetNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"TRACE", "message":"handlePublishResponse: handling [PublishResponse{term=1, version=139}] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}])", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"TRACE", "message":"handlePublishResponse: accepted publish response for version [139] and term [1] from [{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"TRACE", "message":"handlePublishResponse: value committed for version [139] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#6]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.859Z", "log.level":"TRACE", "message":"handleApplyCommit: applying commit ApplyCommitRequest{term=1, version=139, sourceNode={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.860Z", "log.level":"TRACE", "message":"handleCommit: applying commit request for term [1] and version [139]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#10]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.860Z", "log.level":"TRACE", "message":"onPossibleCompletion: [Publication{term=1, version=139}] was successful", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][generic][T#4]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.874Z", "log.level":"DEBUG", "message":"publication ended successfully: Publication{term=1, version=139}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Coordinator.CoordinatorPublication","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.874Z", "log.level":"TRACE", "message":"Reconfigurator{autoShrinkVotingConfiguration=true} reconfiguring VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ} based on liveNodes=[{Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}], retiredNodeIds=[], currentMaster={Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.Reconfigurator","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.874Z", "log.level":"TRACE", "message":"lag detection for version 139 is unnecessary: []", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][clusterApplierService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LagDetector","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.880Z", "log.level": "INFO", "message":"adding index template [metrics-system.load] for index patterns [metrics-system.load-*]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.metadata.MetadataIndexTemplateService","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.880Z", "log.level":"TRACE", "message":"serialized cluster state diff for version [140] in for node version [8.0.0] with size [1333]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.PublicationTransportHandler","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.880Z", "log.level":"TRACE", "message":"handleClientValue: processing request for version [140] and term [1]", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.CoordinationState","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.881Z", "log.level":"TRACE", "message":"setCurrentNodes: nodes: \n   {Joshs-MacBook-Pro.local}{3RiJe2S3TCWXbzwX1pFRxQ}{TfQB3FfST_2kqgYmDPc0OQ}{127.0.0.1}{127.0.0.1:9300}{cdfhilmrstw}{ml.machine_memory=68719476736, xpack.installed=true, ml.max_open_jobs=512, ml.max_jvm_size=1073741824}, local, master\n", "service.name":"ES_ECS","process.thread.name":"elasticsearch[Joshs-MacBook-Pro.local][masterService#updateTask][T#1]","log.logger":"org.elasticsearch.cluster.coordination.LeaderChecker","event.dataset":"elasticsearch.server","trace.id":"a2c0d72e26604a14a016f8b7b1a05f92","elasticsearch.cluster.uuid":"i416wADYTqGeMy1iAUtHvA","elasticsearch.node.id":"3RiJe2S3TCWXbzwX1pFRxQ","elasticsearch.node.name":"Joshs-MacBook-Pro.local","elasticsearch.cluster.name":"elasticsearch"}
{"@timestamp":"2021-09-09T15:23:20.894Z", "log.level":"TRACE", "message":"publishing PublishRequest{term=1, version=140, state=cluster uuid: i416wADYTqGeMy1iAUtHvA [committed: true]\nversion: 140\nstate uuid: 70bgQ2vBRJGLNcBjezC1cA\nfrom_diff: false\nmeta data version: 138\n   coordination_metadata:\n      term: 1\n      last_committed_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      last_accepted_config: VotingConfiguration{3RiJe2S3TCWXbzwX1pFRxQ}\n      voting tombstones: []\n   [.apm-agent-configuration/be-iAyZ0QMmu7iZafmi2Pg]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [c_j4tHVbQJW-onFL63E1pg]\n   [.ds-ilm-history-5-2021.09.09-000001/Jkzi_GQHS16Y_ckjbm4BGA]: v[8], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [_VYEYp8UR4atApeH1WfnaA]\n   [.kibana-event-log-8.0.0-000001/-P_d1q2kTtqFroh47sUufg]: v[10], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [XldW9oLRT_-w11BhvLSCjA]\n   [.kibana_8.0.0_001/Ia6s-13nQYyeVzbn0iPdnA]: v[19], mv[11], sv[2], av[2]\n      0: p_term [1], isa_ids [TywZMX4NQEyZpp8vWhBIvA]\n   [.security-7/v7ZfC4IST72Oy8zGf7O_sg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [vBO-kiOPSAuujh0zkCtYag]\n   [.kibana_task_manager_8.0.0_001/Co3e4yc3S5WDccG2C33PXA]: v[10], mv[2], sv[2], av[2]\n      0: p_term [1], isa_ids [E1wQpniMQ6WDOv0ZR3XKxQ]\n   [.kibana_security_session_1/XdiLTn0MRIivh2eXrLURNg]: v[4], mv[1], sv[1], av[1]\n      0: p_term [1], isa_ids [YJWpkh1PQSeZ9aORp-Fh_g]\n   [.apm-custom-link/dyW77bnBQMuvW5A2DgzoNw]: v[6], mv[1], sv[2], av[1]\n      0: p_term [1], isa_ids [aUHezjW2TMqx2JQxScrULA]\nmetadata customs:\n   ingest: org.elasticsearch.ingest.IngestMetadata@25c99a93   data_stream: {\"data_stream\":{\"ilm-history-5\":{\"name\":\"ilm-history-5\",\"timestamp_field\":{\"name\":\"@timestamp\"},\"indices\":[{\"index_name\":\".ds-ilm-history-5-2021.09.09-000001\",\"index_uuid\":\"Jkzi_GQHS16Y_ckjbm4BGA\"}],\"generation\":1,\"_meta\":{\"managed\":true,\"description\":\"index template for ILM history indices\"},\"hidden\":true,\"replicated\":false,\"system\":false}},\"data_stream_aliases\":{}}   index-graveyard: IndexGraveyard[[]]   component_template: {\"component_template\":{\"logs-system.application@custom\":{\"template\":{\"settings\":{}},\"_meta\":{\"package\":{\"name\":\"system\"}}},\"metrics-mappings\":{\"template\":{\"mappings\":{\"properties\":{\"data_stream\":{\"properties\":{\"type\":{\"type\":\"constant_keyword\",\"value\":\"metrics\"}}}}}},\"version\":1,\"_meta\":